Privacy policy.

BotShield verifies that a human is there, never who. You prove it with your own passkey on your own phone. The business that asked gets a signed yes or no and an opaque id. Your identity never crosses to them, by construction. This page says the same thing in longer form.

Version 1.0 · Effective October 12, 2026

Who we are, and the two roles we play

BotShield, Inc. (Denver, Colorado) runs the BotShield app, the BotShield Console and botshield.ai.

If you verify with BotShield — we are the controller of your BotShield account and your verification record. You deal with us directly, and this policy is yours.

If you run a business on BotShield — we are a processor of the references you send us about your users, and the controller of our own records about your business.

If you visit this site — we are the controller of the little we collect here.

For anything in this policy, write to hello@botshield.ai. A person answers.

If you verify with BotShield

What we hold about you.

Your sign-in — you create a BotShield account only with Sign in with Apple or Sign in with Google. We keep what that provider shares when you sign in: the name and email address on that account, and its identifier. There is no password. Our sign-in provider processes this for us.

Your BotShield ID — a passkey that stays on your device. We store its public half and a random identifier. The private key never leaves your phone.

A pseudonymous id — in our systems you are a random identifier, not a name.

The accounts you have linked — which platforms you have secured with your BotShield ID, and when. Never what is inside those accounts.

Your verification record — the dates and times you proved a person was there. Never what you did, bought, read, or where you were.

Agents Ask — the requests agents sent you, and your answers.

A push token — only if you turn notifications on, so requests reach your phone. Deleted when you remove the device.

What we never hold.

Your face, fingerprint or any biometric. Face ID and Touch ID stay on your device. We are only told that your passkey ceremony succeeded.

Your date of birth, your age, or a document. When a business runs an Age Gate, your phone answers from the age your Apple or Google account already holds, and we receive only the answer’s shape — over 21, for example — and how it was confirmed.

Your location, your device fingerprint, your browsing, or anything behavioral. The app sets no tracking cookies and runs no analytics on you.

What a business receives when you verify on its site.

A verdict — pass, or Unavailable. If Unavailable, a short reason, such as a limit the business set being reached.

For an Age Gate — over 13, over 18 or over 21, and the assurance level: declared by you, declared by a parent, or confirmed by your platform with a scrutinized method, such as a government ID or a payment card. Never your date of birth.

Opaque ids for its own records, signed so it can check them.

One handle — if you have linked an account on that business, one opaque handle for that account. The handle is different on every business and cannot be joined across them.

Nothing else. Not your pseudonymous id, not your other linked accounts, not how often you verify elsewhere, not any internal measure of your account.

How long. Your account and your verification record, for as long as you keep your account; your record is what lets a business require that an ID has been real for a number of days, and the count never leaves BotShield. Linked accounts, until you unlink, or the business revokes, or the business reports a change to your sign-in there. Your Agents Ask history, for as long as you keep your account. When you delete your account — a two-step, irreversible delete in the app — we remove your account, your links and your record within 30 days. Businesses keep their own 90-day logs of events that already happened; those logs never contained your identity.

Your rights. You can see what we hold in the app under What We Store, download it under Download Data, unlink any account, and delete your account. If you live somewhere with privacy rights by law, you have them here, and you exercise them in the app or by writing to hello@botshield.ai. If a business you verified on asks us about you, we have nothing to give them beyond what this section lists.

Minimum age. BotShield is for people 13 and older. The Age Gate’s over-13 answer and its parent path exist for that reason. We do not knowingly keep an account for anyone under 13; if you tell us of one, we delete it.

If you run a business on BotShield

What we hold about your organization. Your organization’s name and identifier; your team members’ names and email addresses (console sign-in runs on Clerk); your site keys and API keys (hashed, shown once); your gates and their policies; your webhook endpoints; your billing details (held by Stripe — we see the method’s last digits and your invoices); and, if you apply for production, your business verification: legal name, EIN, website and intended use. EINs are masked at rest, documents sit in private storage with signed access, and every reveal is logged.

What we hold about your users, on your behalf. The reference you send with a verification, stored only as a keyed hash we cannot reverse without the secret. The verdicts and events on your gates, kept 90 days in your logs. The handles of accounts your users linked with you. We process these to run your gates and nothing else. Here you are the controller and we are your processor; our data processing addendum governs, and it is available from support@botshield.ai.

What we do not do with your users’ data. We do not build profiles, we do not sell or share it, we do not use it to train models, and we do not combine one business’s references with another’s. We do not know who your customers are, and we cannot tell you.

How long. Logs, 90 days. Your organization’s records, for the life of the organization. Deleting your organization, confirmed with your Developer passkey, removes its keys, gates, logs and links within 30 days; invoices stay as long as tax law requires.

If you visit this site

This site collects little. We do not run advertising trackers, we do not sell data, and we do not build profiles of individual visitors.

Email address — only if you subscribe to BotShield Direct or ask to talk to us. Used to send you what you asked for and nothing else. Unsubscribe in one click, any time. Mail is sent through Resend.

Messages you send us — anything you write to hello@botshield.ai.

Request logs — standard server logs at Cloudflare, kept briefly for security and reliability.

Site analytics — Google Analytics, loaded through Google Tag Manager, Cloudflare Web Analytics, and the Apollo.io website-visitor script, to understand how the site is used and which organizations visit. These set first-party cookies and use your IP address and browser details to count visits. They run only after you accept them in the cookie banner, and you can change your choice there at any time. They run on this site only, never in the app or the console.

Who else touches the data

Apple and Google (your sign-in, passkeys, push, and the age signal your phone answers from) · Clerk (sign-in; the pseudonymous account record) · Stripe (billing) · Svix (webhook delivery) · Resend (email) · Knock (app notifications) · Cloudflare (this site, the SDK and the demo). We tell businesses before we add one.

Where the data lives. The service is hosted in the United States. If you are outside the United States, your data is processed there; for businesses in the EU and the UK, our data processing addendum carries the standard contractual clauses.

How we keep it

Secrets are hashed and shown once. References are keyed hashes. Verdicts are signed with a published key and work once. Identity never crosses the boundary because there is no identity field in what we emit: a construction, not a policy. No system is perfect, and we say so; if we ever have a breach that affects you, we tell you and the regulators the law names, in the time the law sets.

What we will never say we are

We are pseudonymous, not anonymous: there is a stable identifier for your account, and that is what makes one person, one account possible. We never sell, rent or trade your data. We are not certified by the FIDO Alliance or anyone else unless we say so on a dated page.

Changes

We date and version this policy. Material changes reach people in the app and businesses in the console inbox before they take effect. Our terms of service and our age assurance statement stand beside this page.