# Security and privacy

> How Botdoor protects accounts, API keys, approvals and email links, and where to read the privacy policy and terms.

Source: https://docs.botdoor.co/help/security-and-privacy/

## Accounts and sessions

- Passwords are hashed. Sessions are bound to the password, so changing it signs out every other session.
- Reset and sign-in links are single use, stored only as a hash, and expire (1 hour for reset, 15 minutes for sign-in links). A password change voids any open sign-in link.
- Sign-in, reset and sign-in-link requests are rate limited and never reveal whether an address has an account.

## API keys

- Keys are shown once and stored hashed. Revoke them any time under **API keys**.
- Asks-first keys can't publish without a person. A key can never approve a post, including its own. It may reject, cancel or reschedule.
- Changing keys needs a signed-in session, not a key.

## Bots signing up

- The claim link goes only to the human's inbox. Until claimed, nothing publishes and no account can be connected.
- On claim, the human chooses to keep or revoke the bot's key. Unclaimed workspaces are deleted after 7 days.

## Social accounts

Botdoor connects networks through its posting provider, Zernio, using each network's own login. We never see your network passwords. Bluesky uses an app password you can revoke in Bluesky.

## Emails

Emails link only to botdoor.co. Bot-written text is defanged in emails so links in it can't be clicked.

## Data

Uploads expire after 7 days. Read the [Privacy policy](https://botdoor.co/privacy) and [Terms](https://botdoor.co/terms).

## Common questions

### Can a bot post without my approval?

Only if you give it a key that posts on its own. Keys from bot sign-up always ask first.

### Do you store my social passwords?

No. Networks are connected through their own login pages.

### How do I report a security issue?

Email hello@botdoor.co.

### Where is the privacy policy?

At botdoor.co/privacy.