What this site records, and what it does not.

Last updated 27 August 2026

The short version

Every request to this site is classified at the edge to work out whether it came from a person, from a browser embedded in an app, or from an AI assistant fetching on someone's behalf. That classification is published to a public live stream. Addresses are truncated before anything is published, query strings are filtered against an allowlist, and there is no analytics product, no advertising pixel and no third-party script anywhere on this domain.

What is recorded for each request

• The path requested, with the query string filtered — see below.
• The HTTP method and the time.
• The User-Agent header, and where present the Referer, Signature-Agent, Signature-Input and Signature headers used for Web Bot Auth verification.
• The network address, truncated before publication: IPv4 to a /24, IPv6 to a /48. Enough to tell an operator's network from a consumer ISP, not enough to identify a connection. Truncation happens once, at the publish boundary, so a full address cannot reach the stream by accident.
• The resulting classification: actor kind, the evidence behind it, and a confidence.

Query strings are filtered, not stored

A hotel URL can carry a name, an email address or a booking reference. Only parameters this design actually uses survive into a published record — utm_source, utm_medium, utm_campaign, ref, source, vsb_src, checkin, checkout, adults, children, room and rate. Everything else is replaced with <redacted> before the record leaves this server. The key is kept and the value is not, so it is visible that a parameter was present without its contents being published.

Cookies

One, and only when there is something to put in it. vsb_src is set when a request arrives carrying an assistant signal, so that the signal survives to the moment somebody clicks through to book. It holds four values: an assistant name, the kind of signal that identified it, a confidence level, and the id of the classification that set it. It contains no personal data, no identifier that persists across sites, and nothing that could be joined to a person.

It lasts 30 days, is scoped to this domain, and is readable by the page script on purpose — the booking-click capture has to read it in the browser. An existing value is never overwritten by a later request that carries no signal, because that would erase the arrival that mattered.

There is no consent banner. There is nothing here to consent to that a banner would meaningfully describe, and a banner that appears on a site with one functional cookie is theatre.

What is never collected

• Names, email addresses, phone numbers or payment details — no form on this site submits any.
• Full IP addresses in any published record.
• Cross-site identifiers, advertising IDs, or fingerprints.
• Anything from a third party. There is no Google Analytics, no tag manager, no embedded map, no hosted font and no CDN script. Every byte this site serves comes from this origin.

The stream is public

Classifications are published to a live viewer on a separate origin, which anyone can watch. That is the point of the demonstration: the evidence behind each verdict is visible rather than asserted. Records are held in a 200-item ring buffer in memory and are not written to any database — there is no database in this project at all. When the process restarts, the log is gone.

Contact

Questions about any of this go to stay@bondicasa.example, noting that the address is a reserved .example domain and cannot receive mail.