What a scan records

Exactly what is stored, what is not, and how bots are handled.

Recorded

When it happened, roughly where (country, region, city), the device kind, operating system and browser, the language, the referrer where there is one, the placement label, and a visitor fingerprint that lets us count people rather than scans.

Not recorded

No IP address is stored. The fingerprint is a one-way hash with a salt that rotates, so it cannot be turned back into a person or followed across a rotation.

Bots

A link pasted into a chat app is fetched immediately by that app to build a preview; a link in an email is fetched by a security scanner before the recipient sees it. None of those is a person.

We record them and exclude them from every report, with the reason kept. Silently dropping them would look like data loss to anybody comparing our numbers with their own.