Privacy

This is a short customer-facing draft. The engineering record of what is collected and why is docs/PRIVACY.md. Counsel should turn both into a published policy and a record of processing before any real customer traffic.

Tellshield processes visitor data on behalf of the customer (the site owner). The customer decides which pages load the SDK and which actions call verify.

We collect timing and structural signals: pointer movement, click timing, key timing without key identity, browser environment consistency, and network facts such as country and whether an IP looks like a datacenter. We do not collect typed text, passwords, or a persistent device identifier.

IP addresses are not stored in the database. A hash is kept for velocity checks. A network-intel lookup may be cached in Redis for about an hour.

Raw interaction events expire with the session (30 minutes). Session rows are kept 7 days. Verification scores and the reasons behind them are kept 90 days, then deleted.

Dashboard accounts store an email and a password hash. Invite links store the invited email until they are accepted or expire.