Privacy notice

Deployment notice: controller identity and privacy contact must be configured before the custom-domain launch.

This site studies how automated clients discover and retrieve a controlled collection of public pages. It does not attempt to identify human visitors.

Controller and contact

Controller: Not configured

Privacy contact: Not configured

Location: Switzerland

What is recorded

For each relevant HTTP request, the service records the time, requested path, method, response status, resource type, protocol metadata, and a crawler classification. Declared crawler user-agents may be retained as supplied. Browser user-agents are reduced to a coarse browser family and major version.

Same-site referrers are stored without query strings or fragments. External referrers are reduced to their origin. Accept-Language and Accept-Encoding are not retained.

Session grouping and IP addresses

Raw IP addresses and reusable IP hashes are not stored by the observatory. When configured, the service uses the source IP transiently inside a keyed HMAC to create an approximate session identifier valid only within a 30-minute time bucket. The source IP is then discarded before the event is written.

Purposes and legal basis

The data is used for crawler research, service security, operational troubleshooting, and aggregated statistics. Where the EU GDPR applies, the intended legal basis is the controller's legitimate interest in operating and studying this public research service, subject to necessity and balancing. Swiss data-protection principles, including proportionality, purpose limitation, transparency, and security, are applied.

Processors, location and retention

Cloudflare provides edge delivery and object storage as a processor. Processing may involve Cloudflare entities and subprocessors outside Switzerland; contractual safeguards are described in Cloudflare's Data Processing Addendum.

Individual request events are retained for at most 30 days and then deleted. Reports may retain aggregated statistics that no longer contain request IDs, session identifiers, referrers, or full user-agents.

Cookies and your rights

The public field guide does not set analytics or advertising cookies. If an optional research journey explicitly offers a temporary session, it remains disabled until the participant activates it.

Depending on the applicable law, individuals may request information, correction, deletion, restriction, or object to processing by contacting the controller. A request may require enough information to locate the relevant event without collecting additional identity data.

Research limitations

A user-agent is a claim, not proof of provider identity. A fetch does not prove indexing, training use, citation, semantic reading, or that a human saw the page.