Security and privacy
Accounts and sessions
Section titled “Accounts and sessions”- Passwords are hashed. Sessions are bound to the password, so changing it signs out every other session.
- Reset and sign-in links are single use, stored only as a hash, and expire (1 hour for reset, 15 minutes for sign-in links). A password change voids any open sign-in link.
- Sign-in, reset and sign-in-link requests are rate limited and never reveal whether an address has an account.
API keys
Section titled “API keys”- Keys are shown once and stored hashed. Revoke them any time under API keys.
- Asks-first keys can’t publish without a person. A key can never approve a post, including its own. It may reject, cancel or reschedule.
- Changing keys needs a signed-in session, not a key.
Bots signing up
Section titled “Bots signing up”- The claim link goes only to the human’s inbox. Until claimed, nothing publishes and no account can be connected.
- On claim, the human chooses to keep or revoke the bot’s key. Unclaimed workspaces are deleted after 7 days.
Social accounts
Section titled “Social accounts”Botdoor connects networks through its posting provider, Zernio, using each network’s own login. We never see your network passwords. Bluesky uses an app password you can revoke in Bluesky.
Emails
Section titled “Emails”Emails link only to botdoor.co. Bot-written text is defanged in emails so links in it can’t be clicked.
Uploads expire after 7 days. Read the Privacy policy and Terms.
Common questions
Can a bot post without my approval?
Only if you give it a key that posts on its own. Keys from bot sign-up always ask first.
Do you store my social passwords?
No. Networks are connected through their own login pages.
How do I report a security issue?
Email hello@botdoor.co.
Where is the privacy policy?
At botdoor.co/privacy.