1Who is who
GrayPass processes behavioral evidence on behalf of its customers. For end users, the customer is the controller and GrayPass is the processor. For customer administrators using the console, GrayPass is the controller of the account data.
2What we collect
Derived behavioral features
Summary statistics about how interaction happened, computed in the browser over short windows: key hold and flight timing distributions, pointer velocity and curvature statistics, scroll cadence, focus and visibility rhythm, and on touch devices the equivalent touch and motion summaries.
Optional eye tracking starts only when you choose to enable the camera. Video is processed on your device. After local calibration, the SDK may send coarse gaze summaries, such as dwell durations and transition rates, with sampling and calibration quality. Camera access is off by default. You can decline or stop it without a camera-related penalty; ordinary interaction collection can continue.
What browser evidence never sends
- Characters typed, clipboard contents, form values, page text, or screen contents as behavioral evidence.
- Raw pointer or touch coordinates.
- Audio, video, or camera frames.
- Eye crops, face geometry, or raw gaze paths.
A customer backend supplies a subject reference when creating a subject. GrayPass converts it to a tenant and environment keyed hash and does not persist the plaintext reference. Customers should send an opaque, data-minimized identifier rather than an email address or name.
Server-side records
- An encrypted behavioral template per subject.
- Assurance Profiles: typed claims with status, coverage, freshness, and limitations. The public demo separately shows an experimental Brainprint continuity index.
- Demo email and free session reports: the address you provide connects derived activity summaries and timestamps to your console account after email verification.
- Decision traces: the action key, digests of the resource and context, the policy version, reason codes, and timing. The original request is also retained in an encrypted envelope when it is needed to re-evaluate a challenge or hold.
- Proof records: identifier, audience, action hash, issue and expiry, and revocation state.
- Operational logs with peppered fingerprints in place of identifiers.
3Why we collect it
| Purpose | Lawful basis (GDPR) |
|---|---|
| Deciding whether a consequential action should proceed | Legitimate interests of the controller in preventing fraud and unauthorized access, Article 6(1)(f) |
| Issuing and verifying a Proof of Agency | Legitimate interests, Article 6(1)(f) |
| Security incident investigation | Legitimate interests, Article 6(1)(f) |
| Research and model improvement | Explicit consent, Article 6(1)(a). Off by default at both the environment and the subject level |
Where behavioral patterns are treated as biometric data under applicable law, the customer is responsible for obtaining any additional consent its jurisdiction requires. GrayPass provides the disclosure language and the deletion mechanisms; it does not decide the customer's legal basis.
4Identifiers are not portable
A subject identifier is opaque and maps to the customer's identifier only through a keyed hash computed per environment. The same person enrolled by two customers produces two unrelated identifiers, and no product surface can join them. There is no cross-site identifier, no third-party pixel, and no analytics vendor.
5Retention
- Sandbox environments: 1 day by default.
- Live environments: 90 days by default, configurable per environment.
- Public demo: Brainprints, visitor subjects, and raw linked evidence become eligible for cleanup after 1 day. Visitors can delete their Brainprint and linked data immediately from the demo or companion.
- Free session reports: the email entered before the demo links a report to the console account with that verified email. Derived activity counts, timestamps, companion connections, and assessments are available for 30 days, then eligible for cleanup. These reports contain no typed words, page content, browsing URLs, camera images, or Brainprint templates. Deleting a Brainprint also removes its linked reports; a signed-in user can delete just a report in Free sessions. Stopping collection preserves the saved report.
- Templates persist until revoked or deleted. The retention window covers decision traces, events, and derived evidence; it never deletes a customer's subjects or templates.
6Your rights
End users should exercise these through the customer whose product they are using. Customers can act immediately through the API or the console:
- Revoke a Brainprint. Outstanding proofs are invalidated at once and the stored template is discarded.
- Delete a subject. The template, live sessions, and subject metadata are removed and cannot be recovered.
- Export what GrayPass holds. The export does not include the template vector, because a template is not human-readable and releasing it would create the cross-context matching risk this policy forbids. The export states that plainly rather than pretending the data does not exist.
- Withdraw research consent at any time, which stops future donation immediately.
7Security
Templates and stored request material are encrypted at rest with keys held outside the database. Production requires separate asymmetric AWS KMS signing keys for sandbox and live proofs; development uses local test keys and non-development configuration accepts no local private-key fallback. What GrayPass does not defend against is documented in the threat model.
8What we will never do
- Sell, rent, or share behavioral data.
- Infer health, disability, neurological status, emotion, demographics, or any trait unrelated to control of a session.
- Measure employee productivity, attention, or engagement. See prohibited uses.
- Build a universal behavioral identity across customers.
9Sub-processors
Amazon Web Services provides hosting, database, key management, and transactional email. Twilio processes SMS step-up verification only when a customer enables it; the canonical challenge API does not offer SMS. No advertising or data-broker processor is used. Customers with an executed data-processing agreement receive notice before a sub-processor is added.
10Contact
Privacy requests go to tools@graypass.org. Use the subject "Data request" for access, correction, or deletion requests; we respond within thirty days.
Vulnerability reports and reports of misuse of GrayPass, including by us, go to founders@graypass.org.