Privacy
Privacy
Current status: this system is built and tested, but not yet deployed to production. Everything below describes what the code actually does, verified against a local database — it has not yet run against real visitor traffic on the live domain. This paragraph comes down once it has.
What this site stores
Two separate datasets. A public one: hashed visitor identifiers (never a raw IP address), country, browser and device type, referrer, and a classification of the request (normal navigation vs. an automated scan). It's aggregate-only — the publictelemetry page never shows a table of individual requests — and it's purged after 60 days by an authenticated job, not just a stated policy. Sixty days is long enough to see month-to-month shifts in scanning patterns and short enough to not sit on data longer than that's useful for. The hash itself is salted, and that salt rotates monthly, so a visitor tracked this month can't be correlated to the same visitor next month even from the hash alone.
A private one, visible only to the site owner behind authentication: the same request data plus the actual IP, network/ASN information, and coarse geography — purged on the same 60-day window. This exists to understand who's actually visiting a professional site: legitimate interest in traffic to one's own site, weighed against how minimal and network-level the data is. Sessions that look like a real visit (not just an automated scan) from a network worth noting may get a short, AI-generated plain-language summary — explicitly labeled as an inference from network metadata, not a confirmed identity, and never generated for traffic that looks purely automated.
The fingerprint demo
The fingerprint demo is opt-in. Nothing runs until you press the button on that page, and it's your own browser it fingerprints. If you leave the consent box checked, only the resulting hash — never the raw signals — is stored, so a return visit can be recognized even across the salt rotation above.
What this site cannot and does not do
It cannot read cookies set by other sites, and it cannot read your browsing history. Those aren't policy choices — browsers don't allow either one, by design, and this site doesn't attempt to work around that.