Privacy Policy
Last updated: March 2026
What TrueWrote Does
TrueWrote verifies that written content was composed by a human by analyzing keystroke timing patterns. We measure how you type, not what you type.
What We Collect
- ✓ Keystroke timing — how long each key is held, the gaps between keypresses
- ✓ Edit patterns — backspaces, corrections, and revision behavior
- ✓ Session metadata — total duration, keystroke count, paste events
- ✓ A one-way SHA-256 hash of your text (for content verification only)
What We Never Collect
- ✗ Your actual written content — we hash it, never store the original text
- ✗ Personal information — no name, email, or account required
- ✗ Advertising cookies — we never track you for ads or remarketing
- ✗ IP addresses in proof records — proofs are anonymous
- ✗ Keypress content — we record timing between keys, not which keys
Cloudflare Turnstile
We use Cloudflare Turnstile to verify that submissions come from real browsers, not automated scripts. Turnstile may set a cookie (cf_clearance) as part of its security check. This is managed by Cloudflare and is not used for tracking. See Cloudflare's privacy policy for details.
How Proof Data Is Stored
When you seal your writing, we generate a proof record containing:
- ✓ A unique proof ID (e.g.,
tr-a8Kx2mNp) - ✓ Aggregated scoring metrics (humanness, effort, integrity)
- ✓ The content fingerprint hash
- ✓ An Ed25519 cryptographic signature
- ✓ Timestamp of creation
Proof records are public — anyone with the proof ID can view the certificate. They contain no personally identifiable information.
Data Retention
Proof records are retained indefinitely so that verification links remain functional. Raw keystroke timing data used for scoring is discarded after the proof is generated and is never stored permanently.
GDPR Basis
For users in the European Union, our legal basis for processing keystroke timing data is legitimate interest in fraud prevention and content authenticity verification. Since we collect no personal data and proofs are anonymous, GDPR data subject requests (access, deletion, portability) are generally not applicable — there is no personal data to link to an individual.
Third-Party Services
TrueWrote uses the following third-party services:
- ✓ Cloudflare — for CDN, DDoS protection, and Turnstile human verification
- ✓ Google Analytics — for anonymous visitor statistics (only with your consent). Collects page views and basic usage data. No writing content or personal data is sent to Google. See Google's privacy policy
We do not use advertising networks or social media tracking pixels. Analytics cookies are only set after you give explicit consent via our cookie banner.
Contact
For questions about this privacy policy or data handling, reach out at [email protected].