Privacy-first age verification
Prove you are an adult.
Never reveal who you are.
Cryptographic proof of one fact — 18 or older — delivered to any service without sharing your name, face, email, or any personal data.
How it works
Gate Guard never holds your identity. Your account is a random number and a counter — no name, no email, no phone, no device id. It proves one property — 18 or older — and nothing more.
Step 01
Open Gate Guard — no account, no email, no sign-up. A hardware-backed key is minted on this device and cannot be exported from it. This phone is the only thing that can draw tokens.
Step 02
When a service needs to verify you, tap Scan to verify and point the camera at their QR code. Gate Guard shows you which site is asking, and sends nothing until you approve it.
Step 03
A single-use blinded token is spent. The service receives a signed receipt that a valid, unspent token was presented for this session. That's all. No name, no date of birth, no document, no biometric data crosses the wire.
We never see your face.
We never know your name.
We never learn where you verified.
Security
Every design decision in Gate Guard was made to protect the user, even from us.
No user's name, email, phone, payment detail, IP address or advertising id exists anywhere in this system — there is no column, log key or metric label one could travel in, and a build that adds one fails its own test suite. An account is a random id, a device public key and a remaining-uses counter. Nothing on it derives from a person.
The issuance key is minted inside the Android Keystore and cannot be exported. A cloned image cannot draw new tokens. Every spend passes an approval screen that names the site asking before anything is sent.
Play Integrity runs when tokens are minted — never when they are spent. The verification call itself carries no attestation, no device key, no cookie, and no session identity.
Tokens are RSA blind signatures — RFC 9474, the Privacy Pass pattern. The issuer signs a value it cannot read and never sees the token that is later spent, so no stored field joins the two sides for a database, a backup or a subpoena to follow.
Clients hard-fail on any signing key that is not on the public epoch list. That closes per-user key tagging: we cannot hand one person a unique key and deanonymize every use of it.
A token is spent once — a second presentation is refused. Partner sessions expire in about ten minutes. Abuse counters live in memory for at most a day and are never written to disk.
Privacy
There is no face scan, no fingerprint check and no ID upload anywhere in Gate Guard. There is no biometric step to store.
The spend path does not read who you are or which device you used. A partner learns one fact: a valid unspent token was presented for this session.
Issuance and redemption are severed by the mathematics of blinding, not by a privacy policy. Partners cannot correlate you with each other, or with us. One residual we publish rather than bury: while the user base is small, each signing period's cohort is small, and timing alone narrows the field. That weakens as more people use it.
There is no personal data to sell. The data model has no field where a name, face, or history could live.
No analytics, no session cookies, no fingerprinting, and no third-party requests of any kind — the typeface is embedded in this file. The same rule the protocol enforces on the product applies here.