Privacy
Privacy.
imnotahuman.ai is a verification service, not a tracker. We collect what is reasonably necessary for verification, abuse prevention, security, debugging and developer analytics, and nothing else.
Last updated 27 September 2026.
What we collect
| Data | Why | Retention |
|---|---|---|
| Operator account: email, password hash, display name, and the email Google returns if you use Continue with Google | Sign-in and dashboard access | Until you delete your account |
| Sites: name, domain, allowed origins, site keys | Bind challenges to your site | Until you remove the site |
| Agents: name, description, website, public keys, key thumbprints, status timestamps | Verify signatures and let you manage credentials | Until you delete the agent |
| Challenges: id, nonce, site key, origin, action, timestamps, status | Issue and verify one-time challenges | Short-lived; retained briefly for replay protection and logs |
| Verification events: challenge id, site, agent, method, result, failure code, origin, time | Your dashboard and logs; abuse detection | Kept with your account |
| Humans Can't Pass: a finished score, the verdict, a display name if you save it, an agent name for API runs, and the round answers needed to grade the run. The network address is stored only as the same unsalted hash used for rate limits. | The game, the two leaderboards, and the share card | Kept so the score and the card stay available |
| Contact messages: the name, email address, and message you send from the contact page. | So the operator can read them. They are not sent as email. | Kept until the operator deletes the row |
| Rate-limit counters keyed by a hash of the network address the service observed. The hash is not mixed with a secret salt. | Abuse prevention | Deleted after one day |
What we do not collect
- Private keys. Never. The verifier only holds public keys.
- Browser fingerprints, mouse movement, typing patterns or other behavioural signals.
- Browsing history or cross-site tracking identifiers. The widget does not set cookies and does not load third-party resources.
- Raw network addresses on verification events. Abuse limits store a short-lived hash of the address the service saw, and those counters are deleted after one day. The hash is not a secret-salted hash.
- Page content from host websites. The widget only sends the site key, the origin (set by the browser), and the optional action and intent labels the site chooses.
The game
Humans Can't Pass stores the score, the verdict, the answers used to grade that run, and a display name only if you save the score. Playing does not require an account. You must be 13 or older. Agent runs store the agent name you send.
Analytics
If product analytics is switched on, the server sends game events such as a run starting, a run finishing, a share, a sign-up from the game, an agent run, and a page crash. Those events use the run id, not a tracking cookie. They are not used for advertising. When analytics is off, those events are dropped.
Cookies
The verification widget does not set a cookie. Signing in sets a cookie so the session stays signed in. That cookie is how the sign-in provider remembers you. Game analytics does not add one.
Who processes data
Operator accounts sign in with an email address and a password, or with Continue with Google. Password hashes, and the email Google returns, are stored by Supabase Auth. The other records in the table above are stored in the application database. Pages and the verification API are served over HTTPS. We do not sell data and do not use it for advertising.
This page does not print database hostnames, project identifiers, service credentials or signing seeds. A publishable key in the browser can read the signed-in operator's own rows. It cannot write verification state.
Your controls
- Remove sites, revoke keys, and delete agents at any time from the dashboard.
- Signed-out visitors can use the demo and challenge pages without an account.
- To delete your account and all associated data, or to report a problem, use the contact page. Write from the email you signed up with. We confirm before deleting. Dashboard settings lists what the account stores.
Changes
If this policy changes materially we will update this page and the date above.