Effective date: November 4, 2025

Who we are

SKRBLR ("we", "us", "our") provides a privacy-preserving security challenge that helps websites distinguish humans from automated scripts. This policy describes how SKRBLR processes data when our anti-bot challenge runs on a customer's site.

Our privacy stance (at a glance)

• We do not sell personal information.
• We do not track people for advertising or build marketing profiles.
• We do not collect names, emails, phone numbers, precise geolocation, or demographic attributes.
• We process minimal, pseudonymous technical signals strictly for security and service quality.

Information we process (minimised)

To provide and improve the challenge, SKRBLR processes:

• Interaction signals: derived vectors/metrics describing how the challenge was interacted with (e.g., path segments, timing, relative speed, stability). We do not store raw drawings/gestures—only derived features.
• Challenge context: result (pass/fail), reason codes, timestamp, and a non-identifying challenge/session ID.
• Device & session basics: browser type/version, OS, screen size, language, feature flags, and truncated IP address (e.g., IPv4 /24 or IPv6 /48). Truncated IPs may be hashed for short-term abuse control.
• Standard server logs (rotated): request time, response code, truncated IP.

We intentionally avoid identity data and demographics. SKRBLR focuses on how a challenge was interacted with, not who interacted.

Purposes of processing

• Security: prevent automated abuse (spam, credential stuffing, scraping).
• Service operation: render, verify, and audit the challenge.
• Quality & research: improve accuracy, latency, and accessibility using de-identified, aggregated telemetry.
• Compliance & fraud prevention: detect and investigate misuse.

Legal bases (Canada + international)

• PIPEDA / BC PIPA: reasonable purposes a user would expect for site security and fraud prevention.
• GDPR/UK GDPR (where applicable): Legitimate interests (Art. 6(1)(f)) for security and service integrity.
• CCPA/CPRA: SKRBLR does not sell or share personal information for cross-context behavioural advertising.

Cookies & local storage (strictly necessary)

SKRBLR may set a strictly necessary token (cookie or localStorage) that stores a random nonce, challenge state, and a recent pass indicator to avoid re-prompting for a short window. We do not use advertising or analytics cookies and do not embed third-party trackers.

Retention

• Security logs: retained ≤ 30 days, then deleted or irreversibly de-identified.
• Aggregated, de-identified metrics: retained ≤ 12 months for quality and model evaluation.
• Customer configuration & billing records: per contract and legal requirements.

Storage location

Data is hosted in Canada. Unless SKRBLR is acquired and you are notified, storage remains in Canada. If an exceptional cross-border transfer were ever required (e.g., CDN failover), we would apply appropriate safeguards and update this policy.

How we protect information

• Encryption in transit (TLS) and at rest for stored telemetry.
• Network/app firewalls and least-privilege access controls with audit logs.
• Encrypted backups with limited retention.
• Secure development practices and ongoing security reviews to minimise data collection.
• We do not disclose proprietary detection methods or algorithmic details.

Children's privacy

SKRBLR is a general-audience security service and is not directed to children under 13. It should be deployed by site owners in contexts appropriate for a general audience.

Your choices & rights

Because SKRBLR processes pseudonymous, minimal technical data and does not attempt to identify individuals, we typically cannot associate telemetry with a specific person without the customer's help. Where law grants rights (access, correction, deletion, objection), submit a request via our contact form, and we will coordinate with the relevant site owner.

Customer responsibilities

If you deploy SKRBLR, disclose its use in your own privacy notice (e.g., "We use SKRBLR for bot protection") and treat challenge outcomes as security data, not marketing data.

Third-party service providers

We use reputable providers for hosting, content delivery, security monitoring, logging, and backups. Providers act under contract as processors and may only process data to deliver SKRBLR. We do not grant advertising or cross-context tracking access.

Changes

We may update this policy to reflect service improvements or regulatory changes. Material updates will be dated and, where appropriate, communicated through our site.

Contact

For privacy questions or rights requests, please use our contact form (coming soon).