Privacy policy
Reverse OTP is operated by Taseen Tanvir. It verifies that a one-time code was received through WhatsApp and completes a verification step in the originating browser. It does not verify ownership of a particular phone number or identify a person.
What we process
We generate a one-time code and process the signed WhatsApp message containing it, its timestamp, and its message ID. Meta’s webhook may also contain the sender’s phone number, WhatsApp user ID, and profile information. These sender details are processed only as part of receiving the webhook and are not saved in our verification database.
We store a hash of the code, a hashed random browser-session identifier, verification status, session timestamps, and the message ID used for verification. Your browser holds an essential session cookie. Phone numbers are not requested or stored by the deployed service.
Why and how long
We use this information to match your message to your browser session, prevent replay and abuse, and operate the service. Codes expire after five minutes. Verified sessions expire after 24 hours. An hourly cleanup removes expired database records, subject to service availability. Hashed network identifiers and rate-limit counters expire within an hour and are removed by the next hourly cleanup. Only send this site’s own verification message; never send another service’s OTP.
Connected game sessions
Fieldwork can create a separate verification challenge through a private server connection. For these challenges we store a hashed challenge identifier, a pseudonymous game-session reference, code hash, timestamps and the WhatsApp message ID. Receipt is bound to the originating game guest; it is not a reusable sign-in token for other guests. These verification-service records expire after five minutes while pending or 24 hours after receipt and are removed by hourly cleanup. The game stores its own verification timestamp for up to 30 days of verified status. Removing verification or deleting the guest account in the game requests deletion of its verification-service records.
Service providers
Meta/WhatsApp delivers your message. Cloudflare hosts the website, Worker, and D1 verification database and processes network information to deliver and protect the service. Their privacy policies apply to their processing. WhatsApp chat history and provider operational records may be retained separately. Deleting data here does not delete your WhatsApp chat or those provider records. Data may be processed in countries other than your own.
Your choices and deletion
You may leave without completing verification. After verification, select “Delete this session’s data” to immediately remove that browser session’s verification record and sign out. Each browser session is separate. See our deletion instructions. For questions, contact hey@tanvir.io.
Cookies, sharing, and changes
The application uses an essential session cookie and adds no advertising or analytics cookies. We do not sell verification data or use it for marketing. We share data with the service providers described above as needed to operate the service and may disclose information when legally required. We will update this page when data practices change.