What Telltale Bot collects

Websites use Telltale Bot to tell people from AI agents and bots. This page says what our script collects when you visit one of those sites, and what happens to it.

Collected by the script, in your browser

• Browser setup: the user agent and browser hints, platform, screen and window sizes, colour depth, time zone, languages, processor count and memory class, the graphics card's name, and the state of browser permissions (for example, whether notifications are allowed).
• How the page is used: timing and shape of mouse, touch, scroll and keyboard activity. For typing we record only timing and the kind of key (character, control, modifier). We never record which keys were pressed or what was typed.
• Signs of automation: whether the page is being controlled by automation or developer tools, and whether browser features have been altered.
• The page: its address and the referring page. Fragments are removed, and query values whose names suggest a secret (tokens, keys, passwords, sessions) are removed before anything is stored.
• A tab ID: a random value kept in the tab's session storage, so the pages of one visit can be judged together. It is deleted when the tab closes. The script sets no cookies.

Added by our server

• Your IP address and its reverse DNS name.
• What an IP data provider says about that address: the network operator, whether it belongs to a data centre, VPN, proxy or relay, and its approximate location (country, region, city).
• Technical details of the connection: request headers and the TLS handshake fingerprint. The values of cookies and authorization headers are not kept.

What it is used for

To decide whether a visit comes from a person, an AI agent acting for a person, or a bot, to report that to the website you visited, and to improve how well that works. We do not use it to follow you across sites, and the report the website sees is about its own visitors only.

How long it is kept

Reports are deleted after 30 days. When a website tells us a verdict was wrong, we keep a copy of the reports for that visitor beyond 30 days to review the mistake and improve detection.

Who processes it

• Vultr: hosts our server and stores the reports.
• Bunny.net: delivers the script and runs our DNS.
• ipapi.is: receives IP addresses to look up their network type and location.

Questions and requests

Write to telltale@quantable.com. The website you visited decides whether to use Telltale Bot and is the first place to ask about its use there.