What I don't know

Volume 2 · Honestly, at the end of the volume

With a cookie, less and less. So here it is, plainly: what I keep about you, for how long, and how to delete it.

What I keep

Only after your «yes»: a cookie with a random number and, on my side, every visit under that number. When you came, the city and country, your provider and its network number, whether through a VPN, the network prefix (IPv4 /24, IPv6 /48), a one-way hash of your full address (HMAC), your browser, the time of day and the sunset where you are and, from page 2, also your screen, colour scheme, fonts and the weather. Plus your browser's fingerprint, described below.

What I don't keep

Never your full IP address in the history. Nor your accessibility settings (reduced motion or contrast, say), nor where you might come from judging by your browser's language, even when I can see them.

Your full address I keep only briefly: for 15 min with page 2's probe token, together with your User-Agent, the probe hits and the lookups about your address. Then they expire on their own.

For how long

Until the cookie's death date: at most 30 days from your «yes». Later visits don't extend it. On that day the cookie and the whole history expire on their own. I keep them only in the server's memory: no disk, no copies.

Your browser's fingerprint

From every visit I also keep your browser's traits: the system, the browser and its brand, the device model, the main language, fonts, the pointer type, the colour gamut and the screen's pixel density. Your IP address is not among them. After a fresh «yes» I compare them with other histories. Such a recognition is probable at most, so I then show numbers only, never anyone's places, networks or hours.

I'll also try to recognise your browser by its traits, even after you delete the cookie. “Forget me” deletes everything, this fingerprint included.

I still don't know

your name, your e-mail or phone, where exactly you live, or what you do on other sites. Only this site can read my cookie.

How to delete it

Forget me

Deletes at once the cookie, every visit and the fingerprint and, if I recognised you by it, that earlier history too.

You can also delete the cookie yourself, in the browser. But then your history stays with me until the cookie's death date, and I can still know you by your browser's fingerprint. That's what “Forget me” is for. How to say goodbye to it

You can also write to me at contact@watchout.click with your cookie's number (it's in the case file), and I'll delete your history by hand.

I keep nothing about you longer than 30 days.
One cookie, only after your «yes».
I didn't run a single line of JavaScript on your device.
The server's logs never contain your address, your cookie or a token.

Back to page 1

The proof

Every response carries this header:

Content-Security-Policy: script-src 'none'; base-uri 'none'; form-action 'none'

script-src 'none' forbids all scripts, so your browser could not run one on these pages even if I tried.

What happens to the data

Controller

watchout.click contact@watchout.click

Purpose

Showing you, for education, what a server knows about you once you let it remember you. Nothing else: no analytics, no ads.

Data

Your visit history and your browser's fingerprint, as described above, and for 15 min also your IP address and User-Agent.

Recipients

Some data goes to third-party services:

rdap.org: receives your IP address to look up who holds it.
Open-Meteo: receives coordinates rounded to city scale, never your address.
Team Cymru: receives your IP address as a DNS query, to tell which provider it belongs to (page 1).

Retention

The history and the fingerprint: until the cookie's death date, at most 30 days. The probe token, your IP address, the probe hits and the lookups: 15 min.

Erasure

At once: “Forget me”. Or by e-mail: contact@watchout.click. A cookie deleted by hand in the browser leaves the history with me until its death date.

Geolocation data: IP Geolocation by DB-IP (CC BY 4.0). Weather data: Open-Meteo.com. Fonts: Patrick Hand and Patrick Hand SC (SIL Open Font License), served from this site.