privacy policy

Controller

Daniel Intrup
E-mail: din.trup@googlemail.com

This is a private, non-commercial hobby and security-research project run by an individual with no business interest in it — there is no separate "Impressum" (§5 DDG "Anbieterkennzeichnung"). The contact above covers anything a formal Impressum otherwise would.

What is collected, and why

This site's purpose is to observe and study which automated agents (bots, crawlers, scanners) access it, as a small piece of open security research. Every request — human or automated — is briefly processed to do that:

Timestamp	to the second
User-Agent string	as sent by the client, verbatim
Requested path, method, status code	e.g. GET /stats 200
Referer	origin only (scheme + host) — the path and query string are discarded before anything is stored, since they can carry search terms or tokens that belong to a third-party site
Accept-Language	as sent by the client
Request-header fingerprint	whether Accept, Accept-Encoding, Sec-Fetch-*, Sec-CH-UA and the HTTP version are consistent with the claimed browser — see the landing page for what this looks like for your own request
IP address	never stored. It is used only in memory, for the current request, to compute a SHA-256 hash of secret_salt : today's date : ip, truncated to 16 hex characters. The salt is generated once per server install, kept only in the database, and never leaves it — so the hash cannot be reversed back to an IP address, on this site or anywhere else. It changes every day, so the same visitor gets a new hash tomorrow.

No cookies or browser storage are used for ordinary visitors, no JavaScript, and no third-party scripts, fonts, or requests of any kind. The one exception is a self-exclusion cookie the operator can set for their own testing traffic — see "Do Not Track" below.

Legal basis

Processing relies on legitimate interest (Art. 6(1)(f) GDPR): operating and securing a small, self-hosted research service, and studying automated web traffic. This is a narrow interest — no profiles are built across sites, no cookies or persistent identifiers are set in an ordinary visitor's browser, and raw IP addresses are never retained.

What is made public

/stats and /api/stats publish aggregate counts and categories — how many requests, bot vs. human, which browsers/OSes/devices, which paths were probed, and so on.

Individual, timestamped request histories are published only for entries classified as bots or crawlers (/stats/ua/<hash>, linked from the statistics tables, the Atom feed and the sitemap). A human visitor's browser is never given its own public, linkable page — it is only ever reflected in the aggregate counts above. Automated agents are not natural persons and so are outside the scope of GDPR to begin with; this separation exists so publication never turns into a public log of an identifiable person's browsing activity.

Decoy endpoints

This server may answer a handful of well-known vulnerability-scanner paths (e.g. /wp-login.php, /.env) with a fake response instead of a 404, to study scanning behaviour. These pages accept no input, have no working form, and their content is entirely fabricated junk — no real system, credentials, or data exist behind them.

Retention

Raw, per-request logs (the table backing the "recent requests" list on a bot's detail page) are deleted after 90 days. Once a human visitor's browser has been quiet for that same window, its aggregate catalogue entry (first/last seen, hit count) is deleted too. Aggregate history for bots and crawlers is kept indefinitely — that long-term "who crawls the web" record is this project's actual purpose, and bots are not people whose data must age out.

Do Not Track / Global Privacy Control

Send the DNT: 1 or Sec-GPC: 1 header and this site will serve your request normally but write nothing to its database — no row, no fingerprint, no contribution to any catalogue entry. Most current browsers can send Sec-GPC via a privacy extension or a built-in setting. Separately, the operator can unlock a long-lived, secret-gated HttpOnly cookie on their own browser for the same effect, so their own repeated testing traffic doesn't pollute the statistics — that cookie carries no information beyond "don't log this browser" and is never set for anyone who doesn't have the secret.

Your rights

Under the GDPR you have the right to access, rectify, erase, or restrict processing of your personal data, to object to it, and to data portability, as well as the right to lodge a complaint with a supervisory authority. Because this site stores no cookies, no account, and no raw IP address, it generally cannot look up "your" specific entries on request — if you believe a specific catalogue entry is about you (for instance, an unusually distinctive browser configuration) and want it deleted, contact the controller above with enough detail to identify it (approximate time, browser/OS) and it will be removed.

Hosting

This site is self-hosted by the controller above; no data is shared with or processed by any third-party service, analytics provider, or ad network.