Privacy
I use limited traffic data to spot automated abuse, understand requests to this site, and keep it running.
Security reporting
The reporting system converts an IP address into a keyed identifier and counts requests and errors. It records approximate country, region and city, network provider, first and last request times, and signals that suggest a browser or automated client.
These signals cannot identify a person or prove that a visitor is human. Locations may reflect an internet provider or VPN. General traffic records do not include raw IP addresses, URLs, query strings, cookies, referrers, user-agent strings or request bodies, and the site adds no tracking cookie.
When JavaScript runs, a small script also reports which page you opened, the name of each link or control you click, and whether real mouse, touch or keyboard input happened. If there was real input, it also reports how quickly the page loaded and whether you're on a phone-sized screen, stored as rounded daily counts with no identifier. It does not report what you type, where you click on the screen, or anything from another site.
Live stream
The vision demo can play a public traffic camera from Seattle DOT or Caltrans. Nothing loads until you press Watch, and then your browser fetches the video from that agency's server, which sees your request as it would on the agency's own site. Each frame goes to a detector running in your browser, which isn't stored or sent anywhere. It marks people and vehicles, follows each one from frame to frame with a number, and guesses a person's posture. It can't identify anyone.
Decoys and AI agents
This site has decoy addresses that no ordinary visitor needs, and notes asking AI agents to identify themselves. Requests to those addresses are recorded with the request method and user-agent string, and an AI agent’s self-reported model name if it gives one. Passwords and other request bodies sent to a decoy are discarded, and nothing is blocked because of these records.
Storage and retention
These records are stored in Cloudflare D1 for the current day and the preceding 14 completed UTC days, with hourly cleanup. Weekly reports are kept privately in GitHub Actions and expire after 14 days. Access is limited to people authorized to manage this site and its repository.
Cloudflare and GitHub also process requests to deliver and protect the site. Their operational logs and database backups follow their own retention policies.
Questions
Contact me through LinkedIn about this site's data use.