HumanApproved™ Docs

Requirements

Small and self-contained. No runtime dependencies, under 15 KB gzipped, built to ES2020.
Works under a strict Content Security Policy and Trusted Types. Nothing inline, no eval, no innerHTML. The panel’s styles are a constructed stylesheet inside a closed shadow root. See Content Security Policy.
Fails open. Unless HumanApproved returns review, the step proceeds within 2.5 seconds (or your timeoutMs).
HTTPS for approvals. The embed uses the browser’s Web Crypto API for the quote details, which is only available on secure (HTTPS) pages. Without it, the step proceeds and the browser console shows the reason.

What it keeps in the browser

The embed uses two storage keys:

Storage	Key	What’s in it	How long
`sessionStorage`	`agent-signals:journey`	Behaviour counts and timings for the visit, the current page’s path, any review in progress or approved (with a hash of the quote details, not the details), any check that got no response, and the journey’s quote (the start of the quote reference), so a new quote starts a new journey.	Cleared when the tab closes
`localStorage`	`agent-signals:visitor`	A random ID that links journeys from one browser.	Until cleared

userId is never kept in the browser’s storage.

What it sends

Each check sends:

the random browser ID,
your userId, if you set one,
after a check that got no response, the reason and time,
the journey’s behaviour counts and timings,
general device characteristics: screen size, time zone, language, window size, font and device counts, and graphics class.

It never reads what’s typed, which keys are pressed, or where the pointer is, and never sends names or page paths: the path stays in the tab’s storage.

On a review, the embed also sends the quote and mobile from your quoteDetails(), so the customer can approve them.

Name the storage and the data sent in your privacy notice and cookie policy before you go live.