Privacy Policy

Effective date: September 24, 2026 · Last updated: September 24, 2026 · Disclosure version: 2026-09-24-v1

This Privacy Policy describes how Dovewood Capital, LLC, a Texas limited liability company (“Authentix,” “we,” “us,” or “our”), collects, uses, and discloses information in connection with the Authentix account authenticity evaluation service available at authentix-account.com (the “Service”).

1. Who this policy covers

This policy addresses three categories of people whose information the Service may process:

Visitors — anyone who uses authentix-account.com, whether or not they submit an evaluation request.
Evaluated accounts — the holder of any X (formerly Twitter) account that a visitor submits for evaluation. This person may have no direct relationship with Authentix and may not be aware that their public account was evaluated.
Relying parties — any third party who receives and verifies a credential issued by the Service, and who may in turn make decisions based on the information returned.

2. Information we collect

From visitors. When you request an evaluation, we record the username you submitted. The Service uses server-side rate limiting to prevent abuse and protect the Service’s underlying data sources. We do not currently collect or persist network-derived latitude/longitude or browser geolocation data.

About evaluated X accounts. When an evaluation is requested, we retrieve and store data about the corresponding X account directly from the X API, including (as available): user ID, username, display name, biography/description, location, website URL, profile image, banner image, verification status, account creation date, follower/following counts, post counts, pinned post, and the text and engagement metrics of the account’s most recent public post.

This data is retrieved from X’s public API in accordance with X’s Developer Agreement and Policy, and reflects information the account holder has made public on X. The account holder has not separately consented to Authentix’s specific use of this data, and may not be aware their account has been evaluated.

Evaluation results, credentials, and consent records. We generate and store a numeric score, a decision classification (approve / review / do-not-approve), a confidence rating, and the underlying signal-level evidence used to reach that assessment. If an evaluation meets our approval threshold, we may issue a one-time verification credential. We store a cryptographic hash of each issued credential (never the credential itself in plain form) along with its issuance time, expiration, and consumption status, and we log verification and issuance events for audit purposes. Before an authenticated user may request an evaluation, the Service requires affirmative approval of the then-current Privacy Policy, Terms of Service, and Disclaimer. We retain an immutable consent record containing encrypted representations of the submitted username and approval response, together with the authenticated account identifiers, disclosure versions, consent schema version, and timestamps, for consent, legal, and audit purposes.

3. How we use this information

To generate the authenticity evaluation and, where applicable, issue a verification credential.
To enforce rate limits and protect against abuse of the Service and of the X API access on which it depends.
To maintain an audit trail of evaluation and credential events.
To operate, maintain, and improve the Service.

4. Disclosure to third parties

X (formerly Twitter). We query X’s API to retrieve the account data described above. This is the source of that data, not a recipient of data we collect independently.

Cloudflare, Inc. The Service is hosted on Cloudflare’s infrastructure, which processes and stores data on our behalf as part of providing that infrastructure, potentially across multiple jurisdictions as part of Cloudflare’s global network.

Network location and X profile location. The Service does not currently collect network-derived latitude/longitude or browser geolocation. An evaluated X account’s profile location field may nevertheless be retrieved from X when it is publicly available, because it is part of the public X account data used by the evaluation.

Relying parties who verify a credential. When a third party submits a valid credential for verification, we return to them the associated evaluation’s username, X user ID, score, decision, and confidence rating for the evaluated account. This means information about an evaluated X account can be disclosed to a party the account holder has no relationship with, based solely on that party’s possession of a valid credential. We do not independently verify what a relying party does with this information after it is disclosed.

We do not sell personal information. We do not disclose data to advertisers.

5. Data retention

Evaluation records, including the underlying evidence retrieved about the evaluated X account, are currently retained indefinitely. We do not currently operate an automatic deletion or expiration process for this data. Consent records are retained as immutable legal and audit records associated with the authenticated account and its evaluation activity, subject to applicable deletion rights and legal obligations.

Credentials expire automatically 15 minutes after issuance or immediately upon use, whichever comes first, and cannot be reused once consumed or expired.

6. Your rights and choices

Depending on your location, you may have rights to request access to, correction of, or deletion of personal information we hold about you. This includes account holders whose public X account was evaluated by a visitor, even though that account holder did not initiate the evaluation themselves.

To make a request, contact us at kellyhorak@authentix-account.com or 817-905-9770. We will need to verify the request relates to an account or record we actually hold before acting on it.

7. Cookies and tracking

The Service uses a small number of security and authentication cookies. During X OAuth sign-in, oauth_state and oauth_verifier are temporary cookies used to validate the OAuth state and PKCE security flow; they expire after no more than 10 minutes. After successful sign-in, authentix_session maintains the authenticated session and expires after 30 days. These cookies are marked HttpOnly, Secure, and SameSite=Lax. They are used for authentication and security, not for advertising or behavioral tracking.

8. Children’s privacy

The Service is not directed to individuals under the age of 18, and we do not knowingly collect information from children. If you believe a child has been evaluated or has submitted a request through the Service, contact us at kellyhorak@authentix-account.com.

9. International data transfers

Because the Service is delivered via Cloudflare’s global edge network, data may be processed in countries other than your own or the evaluated account holder’s own, including the United States.

10. Security

Credentials are stored only as SHA-256 hashes; the plaintext credential is never persisted. Credentials are single-use and time-limited. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above.

12. Contact

Dovewood Capital, LLC
d/b/a Authentix
Fort Worth, TX 76109
Phone: 817-905-9770
Email: kellyhorak@authentix-account.com