privacy

what verifi analyzes

verifi analyzes behavioral and hardware signals to determine whether a visitor is human. none of this is personally identifiable:

mouse movement patterns, velocity, and tremor (8–12hz FFT analysis)
scroll behavior, physics, and micro-corrections
keystroke timing intervals — not the keys themselves
click timing, position variance, and dwell duration
cursor path curvature and overshoot detection
requestAnimationFrame vsync jitter, GPU shader render timing
audio context floating-point precision, font render timing
touch pressure and radius variance (mobile)
browser environment signals: screen dimensions, language, pointer type

verifi does not read form field values, passwords, email addresses, or any content you type.

what's stored

a trust score + session count, in your browser's IndexedDB/localStorage only
hashed IP (HMAC-SHA256) alongside a bot likelihood score (0–100)
anonymized NN weight deltas — the direction the model moved, not raw data
site registrations (name only)

what's never collected

no raw IP addresses — hashed before storage, one-way
no cookies, no cross-site tracking
no personally identifiable information
no keystroke content, no camera/mic access, no form values

IP reputation

on page load, verifi queries a reputation API to retrieve your IP address, then hashes it with HMAC-SHA256 using a server-side secret before any storage. the hash cannot be reversed to the original IP. it's stored alongside a bot likelihood score and used to apply stricter or more lenient verification on future visits.

known malicious IP ranges from public threat intelligence feeds are pre-loaded in hashed form.

federated learning

verifi uses a small on-device neural network to improve bot detection. after a challenge, an anonymized weight delta is sent to a central server — no behavioral data, only the direction the model weights moved. deltas are averaged across all sessions globally; no individual session can be reconstructed from one.

signed tokens

after passing verification, verifi issues a short-lived signed token (HMAC-SHA256, 5 minute expiry) containing only: site ID, issue/expiry time, human probability, and confidence score. verified server-side by the site you're visiting — verifi does not log token verifications.

data retention

NN weight deltas: indefinite — only the most recent ~500 are ever used
IP reputation hashes: indefinite, updated on each visit
site registrations: indefinite
no session logs, no event logs, no raw IP logs

gdpr

verifi does not process personal data as defined by GDPR. behavioral signals are not linked to any individual and cannot be used to identify a person. IP addresses are hashed before storage and cannot be reversed. no consent banner or data processing agreement is required to use verifi.

if you believe this analysis is incorrect for your jurisdiction, contact privacy@zo0p.dev.