evenstamp.com
Get started
// Privacy & data handling

What Evenstamp collects, and how to control it.

Evenstamp is device-identity and fraud-detection software. The deploying site is the data controller; Evenstamp is the engine. This page explains the exact signals, the storage boundaries, and the authenticated export/erase path for a DeviceID.

Last updated 2026-11-07 · Applies to SDK 1.x and engine v2.x

// Collected signals

Signals collected by the browser SDK

Collection is bounded and typed. Raw keystrokes, input values, page URLs, referrers, form contents, cookies, local storage, and clipboard contents are not collected.

Device & display

CPU core count, device memory when exposed, touch points, screen and available resolution, color depth, pixel ratio, color gamut, and HDR support.

GPU & rendering

WebGL vendor, renderer, limits, extensions hash, and shader/clear timings; WebGPU adapter information, limits hash, subgroup size, and atomic-contention timing; a hash of a rendered canvas and a numeric audio-render sum.

OS, locale & fonts

Platform, user agent, User-Agent Client Hints, timezone, languages, the resolved system-font family, measurements for 11 fixed font families, WASM math/timing signals, and speech-voice count/vendor families.

Integrity signals

WebDriver/automation globals, tampered property getters or prototypes, iframe/worker scope mismatches, canvas farbling, 2D-vs-WebGL readback mismatch, and CDP serializer/preload probes.

Network & edge

Challenge and optional WebRTC round-trip times, a local-IP-leaked boolean, and edge telemetry: ASN, JA4/H2 fingerprints, TCP TTL/MSS, TCP/TLS RTT, and a /24 or /48 network prefix.

Behavioral biometrics

Pointer coordinates, pressure, event type and high-resolution timing; key class (alphanumeric, backspace, modifier, other) and press/release timing; scroll deltas and timing; untrusted-event count; and an 8-dimensional kinematic summary.

Derived identifiers

A tenant/origin-scoped BrowserID, a random DeviceID, confidence, risk, spoof/automation score, privacy-tool flag, and anomaly codes. These are derived from the signals above.

WebRTC/STUN is disabled by default. A deploying site can opt in to a first-party stunUrl; if it does, that STUN server sees the visitor's public IP and timing. The SDK does not enumerate installed fonts; it measures a fixed 11-family list.

// Storage boundaries

What is stored, and for how long

Challenge binding

The challenge row stores a one-way HMAC-SHA256 of the client IP, not the raw address. It exists for the nonce TTL (60 seconds by default) and is deleted on use or by GC.

Network prefix

Long-lived identity rows store a truncated /24 (IPv4) or /48 (IPv6) prefix plus ASN, never the full client IP.

Sessions & devices

Sessions are retained for FP_SESSION_RETENTION_DAYS (90 days by default), then removed by a six-hour GC. A device that is still being seen can persist for its device lifetime; the authenticated erase endpoint removes it and its links and sessions immediately.

Raw payload

Full raw payload storage is off by default (FP_STORE_RAW_PAYLOAD=false). When disabled, the session stores a redaction marker; the derived device profile, font metrics, behavioral vector, scores, and edge telemetry are still stored. When enabled, the full typed payload is stored for the session retention period.

SQLite uses secure_delete=ON and Unix file mode 0600. Deletions are recorded in a separate deletion audit log. Backups, WAL checkpoints, load balancers, WAFs, and hosting-provider logs are controlled by the deploying operator.

// Export & erase

DeviceID controls

The SDK returns a DeviceID in its verdict. End users should ask the site operator that displayed this notice. Customers and operators can use the authenticated engine endpoints with an admin bearer token or a tenant API key. Admin tokens can select a tenant with X-Tenant-Id; tenant API keys are scoped to their own tenant.

Export a DeviceID
curl -sS \
  -H "Authorization: Bearer $FP_ADMIN_TOKEN" \
  https://your-engine.example/api/v1/devices/<device-id>
Erase a DeviceID
curl -sS -X DELETE \
  -H "Authorization: Bearer $FP_ADMIN_TOKEN" \
  https://your-engine.example/api/v1/devices/<device-id>

GET returns the matching device row, browser-to-device links, and sessions, including confidence/risk, spoof/automation score, privacy flag, anomaly codes, behavioral summary, edge telemetry, and the stored raw payload or redaction marker.

DELETE removes the device and cascades to its links and sessions. The deletion audit log retains tenant, DeviceID, actor type, and timestamp, but not the identity payload.

// Scope & responsible use

Limits and responsibilities

  • Device fingerprinting and behavioral biometrics can be personal data, and behavioral biometrics may be special-category data. The deploying site must have a lawful basis, a privacy notice, and a deletion path.
  • BrowserID is scoped by tenant and, by default, by the request Origin host when present. The deploying site remains the data controller; Evenstamp does not sell or broker identity graphs.
  • The engine is intended for fraud prevention, account security, and abuse mitigation, not surveillance or discriminatory pricing. Risk scores are advisory and should not be the sole basis for punishment.
  • The visitor playground is a dry run: it computes a report without storing a device or session row, and it redacts the client IP to a prefix or placeholder. It still samples behavior on load and discloses that in its footer.

For access, correction, or erasure, contact the operator of the site that showed you this notice. For engine/operator questions, use the authenticated export and erase endpoints above.