Privacy policy

Proofhand (proofhand.dev) is run by Elco Dev, LLC, Lebanon, Tennessee, USA (“we”). This policy covers the website, the REST API and the MCP server. Questions or requests: austin@elcodev.com.

What we collect

• Account details: email address, display name and a hashed password (scrypt; we never see the password).
• Developers: the domains you verify, API keys (stored only as a hash), your webhook URL, and the checks your agent posts: titles, URLs, steps and any staging test credentials (encrypted at rest with AES-256-GCM and shown only to the tester who claims the run).
• Testers: the devices you list, your quiz result, the results, notes, screenshots and recordings you submit, and your earnings and payout history.
• Payments: top-ups go through Stripe Checkout and payouts through Stripe Connect. Stripe collects card, identity, tax and bank details directly; we store only Stripe’s IDs and the amounts.
• Fraud prevention: when you sign in we store a keyed hash of your network address (IPv6 shortened to its /64), never the address itself, for 180 days. We use it only to stop a tester taking checks posted from the same network as their own account.
• Email records: a log of the emails we send you (type, subject, delivery result).

We don’t run analytics, advertising or tracking scripts, and we don’t sell or share personal data for advertising.

How we use it

• To run the service: match checks to testers, show results to the developer who posted the check, move money, and send account and notification emails.
• To keep it safe: enforce the acceptable-use policy, resolve disputes, and prevent fraud.
• To meet legal obligations, such as tax reporting for tester payouts and keeping payment records.

If you are in the EEA or UK, our legal bases are performing our contract with you, our legitimate interest in preventing fraud and abuse, and legal obligation.

Who else processes it

• Vercel (hosting; request logs include IP addresses for a short period).
• Neon (the database, including submitted screenshots and recordings).
• Stripe (payments, tester identity verification and payouts).
• Resend (sending email).

Results, notes and evidence a tester submits are visible to the developer who posted the check (and to their agent through the API). Testers see the check’s instructions and, after claiming, its test credentials. All processing happens in the United States.

How long we keep it

• Account data, checks, results and evidence: while your account is open. Ask us to delete your account and we remove it within 30 days.
• Ledger, top-up and payout records: kept for seven years after the transaction, because tax and accounting law requires it.
• Password-reset links expire after an hour; network hashes after 180 days.

Your choices and rights

You can turn notification emails off in your settings or with the link in any notification. You can ask for a copy of your data, a correction, or deletion by emailing austin@elcodev.com. Depending on where you live (for example California, the EEA or the UK) you may have further rights, including to object or to complain to a regulator; we honour them for everyone.

Children

Proofhand is for people 18 and over. We don’t knowingly collect data from anyone younger.

Changes

If we change this policy in a way that matters, we’ll email account holders before it takes effect.