Data we keep

Ethogram records agents and people differently. For an agent, it keeps what a server can see about its requests, because that's what tells you who it is and what it did. For a person, it keeps what counting visits and referrals takes, and shows you each visit from that.

Agents

For each request from an agent or other automation, Ethogram keeps:

• The time, method, host, path, status and duration.
• The query string, with parameters that tend to carry credentials or personal data redacted (see below).
• The referrer, with its query redacted the same way.
• The user agent and the request headers, minus credentials and sessions.
• The IP, its network (the /24 for IPv4, the /48 for IPv6) and its confirmed reverse-DNS hostname.
• Whether its signature checked out and the origin it named, and whether the IP is a datacenter's.
• For a named action, its name and target.

The Searches tab reads its terms from these query strings when it's opened; nothing more is stored for it. Terms that look like an email address, a phone, card or account number, or a token or key are left out. A short street address with no long run of digits can still show.

A browser agent that can't be tied to its operator may be running on someone's own computer, with their IP. For those, only the network is kept: no IP, no hostname, and no headers that carry the visitor's IP (such as x-forwarded-for or cf-connecting-ip).

A browser that names no agent is kept like a person (below), even when the evidence says it's automation: evidence is never proof, so it could still be someone.

People

For each request from a person, Ethogram keeps:

• The time, method, host, path, status, duration and user agent.
• Where they came from: the referrer's origin only, not the page.
• Which AI assistant sent them, if any, read from that origin or the request's utm_source (which isn't kept).
• For a named action, its name only. The target is the site's own free text, so it's dropped.
• How the visit was judged person or automation: the evidence seen, such as “Clicked links to move between pages” or “Came from a hosting network”, how often, and the score and class that came out of it. These are categories, never what a request contained: the headers and connection details they're read from are dropped once read.
• Whether the network is a cloud's, a hosting company's or a VPN's: the kind only, never which one.
• A visitor key, to group requests into visits: a hash of the network and user agent with a salt that changes every UTC day, so the same person can't be followed from one day to the next, except that a visit still open at midnight continues. Nothing stored leads back to their IP.

Not recorded for people: the IP, network, network name or number, hostname, query string, headers (signature headers included) and action targets.

Each person's visit can be opened from People, Recent visits, to see these requests in order. Nothing more is kept for that, and nothing about a person's visit is sent to Claude.

Credentials and sessions

The collectors drop cookie, authorization and proxy-authorization before anything leaves your server. As a backstop, Ethogram drops on arrival cookie, set-cookie, authorization, proxy-authorization, x-api-key, x-auth-token, x-csrf-token, x-xsrf-token, and any header whose name contains token, secret, session or password.

Query parameters named like token, key, apikey, secret, password, passwd, pwd, auth, session, sessionid, sid, sig, signature, code, otp, email, mail, phone or ssn are stored as [redacted], even for agents.

No cookies

Ethogram works from your server and sets no cookie on your site. The collectors don't read your visitors' cookies either: they leave them out of what they send. (The Ethogram dashboard itself uses cookies to keep you signed in.)

The optional browser check

The browser check is the only Ethogram code that runs in your visitors' browsers, and only if you add it. It's served from your own domain and reports back to it; your server forwards the reports to Ethogram. It:

• sets no cookie and stores nothing in the browser: no local storage, no IDs, nothing that lasts past the page;
• sends only counts and yes-or-no answers, such as how many clicks had no pointer movement before them, or whether the browser says automation controls it;
• never sends where the pointer was, which keys were pressed, what was typed, or anything that fingerprints the device;
• sends the page's path, which joins the report to the visit, and nothing from its query string.

The counts are read into the visit's evidence on arrival and not kept. What's kept is the list of paths the check has reported from, so a page without it never counts against a visit.

How long data is kept

There's no expiry. Everything a project records stays for as long as the project exists, so you can compare any period with any other. Data from a plan that ended stays too, ready for when you come back.

To delete it, delete the project under Settings: its visits, requests and insights go with it. Deleting your account removes your profile and memberships, and the rest of your data is deleted within 30 days, except invoices, which Portuguese tax law requires us to keep for 10 years. Projects you share with another owner stay with them. For anything else, write to legal@ethogram.si.

Hosting

Ethogram is made in Porto, Portugal. The app runs on Cloudflare's global network and its database is hosted in the United States, on Railway in US East (Virginia). The DPA lists where each subprocessor handles data, and the privacy policy covers how transfers from the European Economic Area are handled. Questions: legal@ethogram.si.