Privacy policy

Version 7, in effect from 12 October 2026. Applies to IRLProof at https://irlproof.me. Ask at privacy@irlproof.me for the version that applied on any earlier date.

The part that is unusual, in full

This service lets you sign in to other websites with the government ID in your phone's wallet, without telling the website, or us, who you are. That only means something if the data practices match, so they are stated here first and in plain terms.

What we take from your ID, and what happens to it

When you sign in to a site with Blind-ID, your wallet shows you what is being requested and you approve it. Your phone sends us a signed response. From it we read three things that together make your document unique: the document number, the country that issued it, and the state or province where there is one. We combine them with the site you are signing in to and a secret key held in a separate key store, and the result is a one-way code. That code goes to the site as its identifier for you. Then everything we read is discarded.

We keep no record of you. There is no account here. We do not keep the code a site receives, we do not keep the values it was made from, and we keep nothing that connects one site's code to another's. Present the same ID at the same site and the same code comes out; that is a calculation, not a lookup.

We never write down your name, date of birth, address, document number, photo, or any other detail about you. Where those values pass through our software at all, they exist only in memory for the moment it takes to process your sign-in, and are never written to a database, a log, or a backup.

What this means in practice

Nothing we hold says who you are, and nothing we hold says which sites you use. Looking at a site's identifier, we cannot tell whose ID it came from. Two sites comparing their users find nothing in common. There is no name, document number or photo to disclose, sell or leak, whoever asks.

It also means something you should know before relying on it: an ID with a new document number is a new person to every site. We have nothing that could say otherwise. A site that wants you to be able to recover an account after your ID changes keeps its own way of doing that.

The one optional thing a site can receive from your ID

A site that is registered with us to check age receives your ID's own yes-or-no answer to "over 18". Your wallet shows you that it is being requested. It is never your birth date and never your age in years. We keep a record of each age check for that site (below), because the site may have to answer for it later.

What is off-limits, and what is not

The personal information shared from your ID is not stored, so nothing here can reach it. That is a fact about how the software is built, not a policy we are choosing to follow. An analytics tool cannot read it, an advertiser cannot buy it, a court cannot compel it, and we cannot look it up, because there is nothing there to read, buy, compel or look up.

The rest of this site is an ordinary website. It uses cookies and analytics like anywhere else, to see how many people visit and which pages they read. It may carry advertising on its own pages. We charge the sites that use the sign-in and the age check. Running this costs money and we would rather say so than pretend otherwise. None of that changes the paragraphs above, because none of it can: the wall between the two is the absence of the data, not a rule about who may look at it.

Everything else

Information we collect

About you, the person signing in: nothing that is kept. The values read from your ID exist in memory for one request, as described above.
A site's sign-in log: when you sign in to a site with Blind-ID, that site is shown, and we keep for 90 days, the time, the site's own identifier for you, the IP address your browser came from and what your browser calls itself. The site sees all of that anyway when your browser reaches it, and nothing from your ID is included. It is the site's record of its own traffic.
What a site asks you for itself: some sites ask you a question or two during sign-in, such as an email address. The page says plainly that the site is asking, not us. What you type goes to that site once and is not kept here. What we keep is a signed receipt naming which fields you agreed to give and when, never what you wrote, so you are not asked again. It did not come from your ID, and only that site receives it.
Age checks at a site: when a site that checks age signs you in, we keep a record of the check for 730 days and give the site a signed copy: the time, the site's identifier for you, the IP address your browser came from, what your browser calls itself, the kind of ID (driver's license or passport), the state and country that issued it, and whether it said you are over 18. It holds nothing else from your ID: no name, date of birth or document number.
Developer console accounts: if you run a site and use the developer console, we keep your sign-in method (an email address, or an identifier from Microsoft, Google, GitHub or Blind-ID), the name you give yourself, your organization's members and sites, and what you change there, for 365 days, with the address you were at. The activity is shown to the members of that organization.
Technical data: ordinary web server records, including IP address, made in the course of serving requests and used only to operate and secure the service.
Cookies: a short-lived cookie that carries your sign-in from your wallet to the site that asked for it, the values needed to complete that sign-in securely, a session cookie for the developer console, and ordinary analytics cookies of the kind most websites use.

How we use it

To complete the sign-in you asked for, to give a site the age answer it is registered for, to apply limits that keep the service resistant to automated abuse, to run the developer console, to understand how the site is used, and to keep the service running and secure. Nothing read from your ID is used for anything beyond the sign-in it was read for, except the country, state and kind of document on a site's age-check record.

Who we share it with

The site you sign in to receives its identifier for you and, if it is registered to check age, the over-18 answer and a signed record of the check. Service providers who host and run the service on our behalf, under obligations to protect it. Otherwise, only where required by law, and see the section above for the limits of what we are able to disclose at all.

Google Wallet's digital identity program requires us to tell Google which sites use Blind-ID and what for, and to stop a site's sign-ins if Google asks us to. Nothing about you is part of that.

How long we keep it

Anything read from your ID: not kept.
A site's sign-in log: 90 days, then deleted automatically.
What a site asked you for: not kept. The receipt naming the fields: until the site removes it, or the site is deleted.
Age checks at a site: 730 days, then deleted automatically, so the site can answer questions about a check after it was made.
Messages sent to a site about its own people: 30 days, then deleted automatically.
Developer console activity: 365 days, then deleted automatically.
Developer console accounts, organizations and sites: until deleted by their owner.

Deleting your data

There is no account of yours here to delete. What exists about your sign-ins is held for the site you signed in to, under that site's identifier for you, and the site is the one that can delete it: ask the site, which can have everything we hold for that identifier removed. A developer console account can be deleted from the console.

Your rights

Depending on where you live you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to certain processing. Contact us at the address below. We cannot connect a request to a sign-in on our own, because we keep no record that would let us; a request about data a site holds for you goes through that site.

Children

This service is not directed at children and requires a government-issued ID in a phone wallet to use.

Security

Data is encrypted in transit and at rest. The secret key used to make a site's identifier is held in a separate managed key store, not in the application database, so that access to one does not give access to the other.

Changes

We will update the date at the top when this changes. Material changes will be announced on the site.

Contact

privacy@irlproof.me

IRLProof and Blind-ID are operated by Kwitwell, LLC.