Privacy Policy

Effective date: October 12, 2026 · Last updated: October 12, 2026 · Disclosure version: 2026-10-12-v1

This Privacy Policy describes how Dovewood Capital, LLC, a Texas limited liability company (“Authentix,” “we,” “us,” or “our”), collects, uses, and discloses information in connection with the Authentix account authenticity evaluation service available at authentix-account.com (the “Service”).

1. Who this policy covers

This policy addresses three categories of people whose information the Service may process:

Visitors — anyone who uses authentix-account.com, whether or not they submit an evaluation request.
Evaluated accounts — the holder of any X (formerly Twitter) account that a visitor submits for evaluation. This person may have no direct relationship with Authentix and may not be aware that their public account was evaluated.
Relying parties — any third party who receives and verifies a credential issued by the Service, and who may in turn make decisions based on the information returned.

2. Information we collect

From visitors. When you request an evaluation, we record the username you submitted. The Service uses server-side rate limiting to prevent abuse and protect the Service’s underlying data sources. When you request an evaluation, Cloudflare tells us the approximate location of the network your request came from, and we record it with that evaluation: the Cloudflare data center that handled the request, the country, continent, region and region code, city, postal code, metro code and timezone, together with the network’s autonomous system number (ASN) and its organization name. It is derived from your internet connection, not from your device’s GPS, and it is approximate: it can point to your internet provider rather than to where you are. We keep it encrypted as part of that evaluation’s audit record and show it only to you, on that evaluation’s result. It is not included in shared results or report PDFs and is not sent to X or xAI. It is kept as described in Data retention; clearing your evaluation history removes the evaluation from your history but does not delete this record. Latitude and longitude are not recorded, and browser geolocation is never collected; records made before October 7, 2026 may also contain the approximate latitude and longitude Cloudflare reported at the time, kept encrypted like the rest of that record. Rate limiting counts requests using a one-way code computed from your IP address with a secret key and the date, so it changes every day; your IP address itself is not stored.

About evaluated X accounts. When an evaluation is requested, we retrieve and store data about the corresponding X account directly from the X API, including (as available): user ID, username, display name, biography/description, location, website URL, profile image, banner image, verification status, account creation date, follower/following counts, post counts, pinned post, and the text, timestamps, references, and public engagement metrics of posts returned in the evaluation’s 30-day public activity corpus, including the most recent public post.

This data is retrieved from X’s public API in accordance with X’s Developer Agreement and Policy, and reflects information the account holder has made public on X. The account holder has not separately consented to Authentix’s specific use of this data, and may not be aware their account has been evaluated.

AI Analysis. Eligible users may receive an automated AI-generated interpretation after an evaluation. The AI layer reads the stored evaluation result, deterministic signal evidence, account facts, seven-day activity aggregates, and the stored 30-day public post corpus. AI output does not change how the AAE-1.0 score is calculated, but automated AI readings, including the Grok assessment, are part of the final score, as described in Final score and Grok assessment. Generated analysis may be cached with the associated evaluation record for authorized future retrieval.

Administrator evaluation access. Authorized Authentix administrators may evaluate an account other than the X account used for sign-in. Administrator status is enforced server-side from the authenticated user record; ordinary users remain restricted to their authenticated account.

Evaluation results, credentials, and consent records. We generate and store a numeric score, a decision classification (approve / review / do-not-approve), a confidence rating, and the underlying signal-level evidence used to reach that assessment. If an evaluation meets our approval threshold, we may issue a one-time verification credential. We store a cryptographic hash of each issued credential (never the credential itself in plain form) along with its issuance time, expiration, and consumption status, and we log verification and issuance events for audit purposes. Before an authenticated user may request an evaluation, the Service requires affirmative approval of the then-current Privacy Policy, Terms of Service, and Disclaimer. We retain an immutable consent record containing encrypted representations of the submitted username and approval response, together with the authenticated account identifiers, disclosure versions, consent schema version, and timestamps, for consent, legal, and audit purposes.

3. How we use this information

To generate the authenticity evaluation and, where applicable, issue a verification credential.
To enforce rate limits and protect against abuse of the Service and of the X API access on which it depends.
To maintain an audit trail of evaluation and credential events.
To operate, maintain, and improve the Service.

4. Disclosure to third parties

X (formerly Twitter). We query X’s API to retrieve the account data described above. This is the source of that data, not a recipient of data we collect independently.

Cloudflare, Inc. The Service is hosted on Cloudflare’s infrastructure, which processes and stores data on our behalf as part of providing that infrastructure, potentially across multiple jurisdictions as part of Cloudflare’s global network.

Network location and X profile location. The Service records the approximate network location of each evaluation request, but not its latitude or longitude, as described in Information we collect. Browser geolocation is never collected. An evaluated X account’s profile location field may nevertheless be retrieved from X when it is publicly available, because it is part of the public X account data used by the evaluation.

Relying parties who verify a credential. When a third party submits a valid credential for verification, we return to them the associated evaluation’s username, X user ID, and AAE-1.0 score, decision, and confidence rating for the evaluated account. Credentials are based on the AAE-1.0 result, not on the final score. This means information about an evaluated X account can be disclosed to a party the account holder has no relationship with, based solely on that party’s possession of a valid credential. We do not independently verify what a relying party does with this information after it is disclosed.

xAI. We send xAI public information about the checked account, as described in Final score and Grok assessment, so that its Grok model can return an assessment. Visitor notifications. When someone opens the home page, we send ourselves a short notification through a third-party notification service, at most once an hour for the same browser: the visitor’s country (as Cloudflare reports it), whether the device is a phone or a computer, the website that linked to the page (its domain only), and, if the visitor is signed in, their X username, or otherwise the word anonymous. Automated agents and our own administrators are not included. To avoid repeat notifications we briefly keep a one-way code made from the visitor’s IP address and browser, in Cloudflare’s cache for one hour; we do not store the notification ourselves, and the notification service keeps it under its own terms. We never sell personal information, and we never disclose data to advertisers.

5. Data retention

Evaluation records, including the underlying evidence retrieved about the evaluated X account, are retained until you delete the reading, as described in Keeping or deleting a reading. We do not currently operate an automatic deletion or expiration process for this data. Consent records are retained as immutable legal and audit records associated with the authenticated account and its evaluation activity, subject to applicable deletion rights and legal obligations.

Credentials expire automatically 15 minutes after issuance or immediately upon use, whichever comes first, and cannot be reused once consumed or expired.

6. Your rights and choices

Depending on your location, you may have rights to request access to, correction of, or deletion of personal information we hold about you. This includes account holders whose public X account was evaluated by a visitor, even though that account holder did not initiate the evaluation themselves.

To make a request, contact us at kellyhorak@authentix-account.com or 817-905-9770. We will need to verify the request relates to an account or record we actually hold before acting on it.

7. Cookies and tracking

The Service uses a small number of security and authentication cookies. During X OAuth sign-in, oauth_state and oauth_verifier are temporary cookies used to validate the OAuth state and PKCE security flow; they expire after no more than 10 minutes. After successful sign-in, authentix_session maintains the authenticated session and expires after 30 days. These cookies are marked HttpOnly, Secure, and SameSite=Lax. They are used for authentication and security, not for advertising or behavioral tracking.

8. Children’s privacy

The Service is not directed to individuals under the age of 18, and we do not knowingly collect information from children. If you believe a child has been evaluated or has submitted a request through the Service, contact us at kellyhorak@authentix-account.com.

9. International data transfers

Because the Service is delivered via Cloudflare’s global edge network, data may be processed in countries other than your own or the evaluated account holder’s own, including the United States.

10. Security

Credentials are stored only as SHA-256 hashes; the plaintext credential is never persisted. Credentials are single-use and time-limited. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Evidence view and AI-assisted analysis

When you ask us to check an X account, we build an evidence view from public information about that account that X makes available to us: the public profile (name, bio, location, link, profile picture, join date, verification status, and public follower, following, post and list counts), public posts from roughly the last 30 days (their text, time, kind, public like, reply and repost counts, links, and the pictures attached to them), and public lists and a small sample of recent followers and accounts followed, which we use only in aggregate and never display by name.

We analyze this information automatically. Some of the analysis uses artificial-intelligence models run for us by Cloudflare, Inc. on its Workers AI service, which receive the text and pictures needed to produce the analysis. The analysis can describe a picture, read text that appears in it, and offer an estimate of whether a picture may have been generated or heavily edited by AI. These estimates are opinions and can be wrong. We do not use facial recognition, we do not identify or name people shown in pictures, and we do not create biometric templates.

We use this information only to produce the evidence view for the customer who requested the check. We do not use it to train our own models and we do not sell it. We keep the results with the evaluation in your history, encrypted at rest. We store the analysis, including text read from pictures, and links to pictures hosted by X; we do not store copies of the pictures. These results are deleted when you clear your evaluation history or delete the reading. You can also ask us to delete them sooner by contacting us using the details in this policy.

If you hold an X account that someone else has checked and you want information about it removed from our records, contact us using the details in this policy and we will review the request.

12. Deeper evidence view and automated reading of posts

For plans that include it, the evidence view can read more of what X makes available about the checked account: all of its public posts from roughly the last 30 days that X returns (up to X’s own limits), the public posts those posts reply to or quote, public posts by other accounts that mention it together with those accounts’ public usernames and basic public profile details, the public lists it owns or follows, X’s own daily post counts, and the public Spaces it hosts. Posts written by other people are used only as context for the checked account and are never the subject of a check.

When you check your own account while signed in with X, the evidence view may also use your sign-in, only for that check, to read your own likes and, if your account is protected, your own posts. We do not refresh or keep your sign-in for this, and we never use it to read anyone else’s non-public information.

Some plans include an automated reading of the account: artificial-intelligence models run for us by Cloudflare, Inc. on its Workers AI service read the bio, posts, replies and the posts they answer, mentions, lists, likes where available, and the picture analysis, and give scores for authenticity, credibility, behavior, conversation context, alignment between the bio and the posts, language, and pictures. Each score must cite the posts it relies on, and a reading that cites anything not in the evidence is discarded. These scores are automated opinions about public content and they have not been validated against accounts of known origin. They do not change the AAE-1.0 result, but they are part of the final score, as described in Final score and Grok assessment.

These results are stored with the evaluation, encrypted at rest, replaced when a newer check of the same evaluation finishes, and deleted when you clear your evaluation history or delete the reading.

13. Price quotes

When you ask for the price of a check, we read a small amount of public information about the account you name before anything is purchased or run: its public profile and X’s own counts of how many posts, and how many posts with pictures, it published in roughly the last 30 days. We use this only to calculate the price, and to start the check without reading it again if you buy it. We keep the quote with your account so that a paid check can be matched to the account it was priced for.

14. Final score and Grok assessment

When a check finishes, we calculate a final score from 0 to 100 and keep it with the evaluation. 20% of the final score is an assessment by Grok, an artificial-intelligence model provided by xAI. To produce it, we send xAI the public information about the checked account that the check uses: its public profile (name, username, bio, location, link, join date, verification status and public follower, following, post and list counts), its pinned post, the text, time and public engagement counts of its recent public posts, and our automated readings of the pictures in those posts, but not the pictures themselves. xAI also receives the public profile and recent public posts for a separate automated check for impersonation, unsupported claims and scam patterns. We send xAI only information about the checked account, never the name, email address, sign-in or payment details of the customer who requested the check. xAI processes this information to return its assessment, under the terms that apply to its API.

The other 80% of the final score combines a score for the account’s public profile and activity (a base weight of 20%), the score from the 30-day evidence view (30%) and the automated reading scores (30%); each of these weights is reduced when that score is less confident, and the three are then rescaled to share the 80%. Within each score, information that is missing or could not be read earns no points, so it lowers the score rather than being left out. Only a part of the check that could not run at all, for example because a provider failed, is left out, and the remaining parts are rescaled to make up the whole score. Automated readings of whether a picture was generated or altered by artificial intelligence count toward the final score and are shown next to the post the picture belongs to.

The final score, its decision and confidence, and the scores it was built from are what your evaluation history, shared results and report PDFs show. The AAE-1.0 score is still calculated and kept with the evaluation, and verification credentials are issued and verified on the AAE-1.0 result, not on the final score.

15. Keeping or deleting a reading

After each reading we ask whether you want to keep your own copy on your device, delete the reading now, or do neither. If you do neither, the reading stays on our servers, in your history, until you delete it.

Delete now. If you choose Delete now, we permanently delete the reading from our servers, together with everything we stored about it: the evidence, the post and picture analysis, the AI interpretation, any share link, any verification credential and the consent and audit records tied to that reading. This cannot be undone. We keep only our payment and billing records for the check, which we are required to keep, and they no longer point to the reading. A reading that is subject to a legal or investigative retention hold cannot be deleted while the hold lasts. Backups and caches may hold a copy for a short time after deletion, including a share image that has already been cached.

Saving to your device. If you choose Save to this device, a copy of the reading is stored in this browser on this device only, using the browser’s own storage. It is never sent to our servers. AuthentiX, including its administrators, will not open, read or copy that copy without your explicit written consent. We cannot control who else can use your device or browser: anyone who can use this browser profile, software or browser extensions you have installed, and the browser itself can see it, and clearing this site’s data in your browser erases it. Saving a copy does not delete the reading on our servers, and deleting the reading on our servers does not remove your device copy. You can open or remove your saved copies at any time from Menu, Saved on this device.

16. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above.

17. Contact

Dovewood Capital, LLC
d/b/a Authentix
Fort Worth, TX 76109
Phone: 817-905-9770
Email: kellyhorak@authentix-account.com