AttestOS

Privacy policy

Last updated 27 October 2026.

Your visitors (sites using the widget)

When a page with the AttestOS widget loads, the visitor's browser requests a challenge from our service on Cloudflare's network. We process:

  • The page hostname (to check it belongs to the site), the IP address (only for per-IP rate limiting at the edge; not stored) and the user agent.
  • When a solution is redeemed: a small set of browser facts used for the risk score (whether navigator.webdriver is set, number of languages and plugins, CPU core count, window size, the WebGL renderer name, a DevTools-protocol check, how long the solve took). These are evaluated and discarded; only the resulting risk number and signal names are kept with the token record.
  • A token record (random token id, time, method, hostname, risk) kept for 90 days so site owners can audit verifications.

No cookies are set by the widget, nothing is used for advertising or cross-site tracking, and we don't sell data. Passkeys: we store the public key, a counter and the user id the site gave us; never biometrics or private keys. Private Access Tokens are anonymous by design; we verify a signature and store nothing that identifies the device.

You (account holders)

  • Email address and a salted password hash (PBKDF2), your sites, settings and usage counts.
  • Purchases: Whop processes payment. We receive the email, plan and membership status for your purchase, never card details.
  • Transactional emails (confirmation, password reset, purchase) are sent from our mailbox.

The free scanner and outreach

The scanner fetches public pages (the page you enter, its robots.txt and security.txt) and stores the report for 90 days so it can be shared. If you leave your email to ask for help, we keep it to reply to you.

We may email businesses once, with one follow-up, about a public sign-up or contact page we scanned, using an address the business publishes for contact. Every such email says how we found the address and carries a one-click unsubscribe; unsubscribes and bounces are suppressed permanently.

Processors

Cloudflare (hosting, database), Whop (checkout), GitHub (code and scheduled jobs).

Your rights

Ask for a copy or deletion of your data by emailing the address in our security.txt or replying to any email from us. Deleting a site in the portal removes its keys, passkeys and agent keys immediately; token records expire after 90 days.