Privacy

On websites that use Telltale Bot

The website decides to use Telltale Bot and is responsible for that use (the controller). We process the data for the website (its processor), under an agreement with it.

Our script collects technical information about the browser and device, how the page is used (such as the timing of mouse, touch, scroll and keyboard activity), and the page's address. Our server adds the IP address, information about the network it belongs to (such as the operator and approximate location), and technical details of the connection. A website with member accounts may also send the ID it gives a signed-in member.

We never record what you type. The script sets no cookies. It keeps a random ID in the tab's session storage so the pages of one visit are judged together, and the browser deletes it when the tab closes.

What it is used for

To decide whether a visit comes from a person, an AI agent acting for a person, or a bot; to report that to the website; and, where the website allows it, to improve detection. We do not use the data for advertising or to build profiles of people across websites, and a website sees reports about its own visitors only. It sees people's IP addresses only if it chooses to show them.

Legal basis and consent

Telling a person from automation means looking closely at the browser: how it is set up and how it behaves. The GDPR recognizes preventing fraud (Recital 47) and keeping networks and services secure (Recital 49) as legitimate interests. We recommend that websites rely on their legitimate interest in protecting their site, analytics and advertising from automated traffic and fraud, rather than on consent; we rely on ours in improving detection. A detector that only ran after consent would mostly miss automation.

In return we keep to what detection needs: no record of what anyone types, no cookies, nothing kept on the device after the tab closes, reports kept only briefly (below), and no use for advertising or profiling. You can object at any time (below). Each website decides its legal basis, and whether to run Telltale Bot before or after a visitor's consent, under the rules that apply to it.

How long it is kept

Each report's full contents are deleted after 10 days. What the reports site keeps of each pageview (its time and page, the visitor's IP address, network, browser and member ID, and the verdict) and our server logs are deleted after 30 days. We also keep each website's daily counts (how many visitors and pageviews, by verdict, by the agent or crawler named, and by country and region) for 13 months, so the website can see trends. They hold no IP address, page address or anything else about a single visitor, and are deleted when the website clears its data or closes its account. A copy of a visitor's reports that a website sends us to correct a verdict is deleted 30 days after it was sent; a few may be kept as test cases after the IP address, host name and page address are removed. Encrypted backups are kept for 14 days.

Where it is stored, and who processes it

The data is stored in the United States: our server is in Chicago, and our encrypted backups are in New York. For websites subject to EU or UK data protection law, our agreement with the website includes the EU Standard Contractual Clauses and the UK Addendum. Our service providers:

• Vultr: hosts our server.
• Bunny.net: delivers the script, runs our DNS, and stores our encrypted backups.
• Resend: sends emails about logins to our reports, and the scheduled reports a website asks for, which carry its report data.

Their legal names, and every change to this list (with an RSS feed), are on our subprocessors page.

On this website

This website runs the Telltale Bot script too. For visits here, Quantable is the controller, for the same purpose and on the same basis: to know which of our visitors are people, AI agents or bots.

We also count visits here with Plausible Analytics, which sets no cookies and keeps no personal data: it tells visitors apart by a hash of the IP address and browser that changes every day, and stores its data in the EU.

If you joined our waitlist, we keep what you sent in the form and the IP address it came from (to filter out spam). It is stored on this website’s host, hosting.com, and emailed to our mailbox at Fastmail. We use it only to contact you about Telltale Bot, and delete it when you ask.

If you email us at support@telltale.bot, your message and our reply are kept in that mailbox at Fastmail.

If you sign up or have a login to the reports

For this data, Quantable is the controller.

Signing up. We keep what you enter (your email address, your company or your name, the website and, if you signed up before October 18, 2026, your country and the pageviews you expect) to set up and run the account, bill it, and know who our customers are. When an account accepts our terms, we record which login accepted them, its email address, the IP address and the time. The sign-up pages run the Telltale Bot script, as this website does, so we know whether a person, an AI agent or a bot is signing up.

Your login. We keep your email address, a hash of your password, your settings and when you last signed in. If you turn on two-factor sign-in, we also keep your authenticator's key and one-way hashes of your recovery codes. We email you about your login (a confirmation, an invite, a password reset), about your account (such as its plan usage, or that it was closed), and the scheduled reports you or your organization ask us to send you.

Cookies. The reports site (app.telltale.bot) sets only the cookies signing in needs: one that keeps you signed in (14 days, or until you sign out), one that lasts five minutes between your password and your two-factor code, and, only if you ask for it, one that skips the code on that browser for 30 days. No analytics or advertising cookies.

Paying. Payments are handled by Stripe. Card details go straight to Stripe, never to us. Stripe keeps the billing name, address, email address and any tax ID, and sends receipts and invoices. Until you give a billing address, Stripe also gets the IP address you signed up from, to work out sales tax. We keep only Stripe's reference to the account and the plan's status. Stripe also uses the data under its own privacy policy, for example to prevent fraud and to meet its legal duties.

Why we may. To perform our contract with your organization (or with you); to keep invoice and tax records, our legal duties; to know who signs up and keep out abuse, our legitimate interest.

How long. A login is deleted when it is removed from the account or the account is closed (anyone who can see all of an account's sites can close it, under Account settings › Close account). When an account is closed, its sites' reports and its logins are deleted at once. We keep the sign-up details and the record of the accepted terms after that only as the record of our agreement, for as long as a claim about it could still be made or the law requires us to, and Stripe keeps invoices as long as tax law requires.

Who helps us. Vultr and Bunny.net (as above), Resend (sends our emails), Stripe (payments) and Fastmail (the email we receive).

If you get scheduled reports without a login

A website that uses Telltale Bot gave us your email address so we would send you its reports. We keep the address only for that, and delete it when you unsubscribe (every report has a link), when the website removes you, or when it deletes the report.

Your rights

You can ask for access to your data, its correction or deletion, or object to its use, and you can complain to your data protection authority. For a website that uses Telltale Bot, ask that website first; we will help it answer. Otherwise, or for this website, write to support@telltale.bot.

Last updated November 9, 2026.