Session records hold: your IP address, user-agent, the gesture seed, your trace timing summary (never the raw trace after scoring), the verdict, and a coarse score. No accounts, no email, no names — there is nothing to leak.
No cookies for tracking, no fingerprint resale, no third-party analytics beacons. The address used for the three-strike rule exists to keep the game human — nothing else.
Session detail is scrubbed on terminal state; the score + flag summary persists for audit. Cards persist until revoked.