Pilot · from go-live
Level 1, Tap. The stand's chip should make a fresh one-time code for each tap. This is the level the pilot uses.
How Hereby works
What happens when someone taps.
The tap
- Tap. A customer holds their phone to the stand and a page opens in their browser. They don't need an app or an account, and we don't ask their name.
- Read. The page says the visit is recorded and has a short privacy note: who we are, what's recorded and why, how long we keep it, and how to delete it.
- Choose. They can send the owner a private message, leave a public Google review, or skip. Everyone sees the same choices, laid out the same way.
- Thanks. If they sent a message, the thank-you page also offers the Google link. The owner can reply.
Pilot · from go-live
What is recorded, and what isn't
What is recorded
- The place, and the time window of the visit
- A random ID for that place, stored in a cookie in the visitor's browser (each place gets its own random ID, so one place can't recognise you at another)
- The choice they made, and the message if they wrote one
What isn't
- Your name, your phone number, your email
- Anything from people who didn't tap: no Bluetooth or Wi-Fi scanning, no background tracking
Tap events are deleted after 90 days. Hereby's app, database and backups are hosted in Toronto, Canada.
Built so a tap is hard to copy Pilot · from go-live
There's a small chip inside each stand that tells us which place it is. Each tap should make a new one-time code, so a screenshot or a copied link gets rejected. We'll test that during the pilot. If the stand can't be tapped and someone scans the QR code instead, the visit is marked "visit recorded", not "tap-verified", and counted separately.
Hereby verifies a visit. It doesn't verify a review or a rating. What someone says is up to them.
Three levels of trust
Planned
Level 2, Stay. For uses with more at stake, such as a paid campaign, a visitor can agree to a check that their phone stayed a while. The check runs on their own phone and uses its Bluetooth only if they agree. Nothing is collected from anyone who didn't opt in.
Planned
Level 3, Human. For the uses with the most at stake, a partner confirms that the person is a unique human, without Hereby learning who they are.
The independent audit trail
Planned We plan to publish a fingerprint of every proof Hereby has issued to a public record on a regular schedule, so anyone can check that our record wasn't changed afterwards. We haven't chosen which public record yet. The fingerprint is meant to reveal nothing about any single visit.