MINIMIZE WHAT MOVES

Presence verified.
Privacy considered.

This is a technical privacy notice for the current implementation. Production processing requires a completed legal and privacy review, controller contact details and region-specific notices.

What your application receives

A verification outcome, assurance policy, method, fresh-presence indicator, prior enrollment type, application-specific pseudonym, protected action, timestamps and a unique verification ID. Applications do not receive face images, biometric templates or identity documents.

What I’m Real retains

Credential public keys, credential status, minimal enrollment evidence metadata, an opaque provider reference, transaction records, usage and security events. Raw biometric payloads are not stored by this application. Temporary provider tokens are encrypted and removed after validation. The provider may process and retain biometric data under its own configured retention policy and processor agreement.

Your choices

You can use an existing enrolled passkey or another approved authenticator. New enrollment uses an approved liveness provider when configured. If the available method is inaccessible, contact the requesting service for an assisted route. This deployment does not currently offer an assisted route.

Access, revocation and deletion

Visit Your passkeys to sign in with an enrolled passkey, name or revoke authenticators, download an account snapshot, or request a full access review or deletion. Revocation prevents that credential from authorizing further verification. Deletion requests immediately revoke the enrollment and require review of provider-held records and applicable security, contractual and legal retention obligations. This release does not promise instant erasure of all records.

Production requirements

Before live biometric processing: determine GDPR controller and processor roles, an Article 6 lawful basis and applicable Article 9 condition, complete a DPIA where required, contract provider retention and deletion, document international transfers and publish a working data-rights contact. A checkbox and technical controls do not by themselves establish legal compliance.