What this site does with your data
A page about being measured has no business being vague about its own collection. This is all of it: what stays on your machine, what the server keeps, for how long, and what is never done at all.
Everything here is checkable in the source.
The short version
Nothing about you is collected for any purpose of this site's own. There is no analytics, no advertising, no third-party script, and nothing is ever sold or shared. Two of the demonstrations need the server to remember something for up to a day, and both are described below.
What stays in your browser
Almost every value on the data page is measured by JavaScript running on your machine and rendered there. It is never sent anywhere. That includes your fingerprint, your fonts, your hardware, your screen, your preferences and everything you do on the page. Exporting the record writes a file locally; nothing is uploaded.
What this site writes to your machine
The persistence demonstration writes one random identifier into seven places in your browser at once: a cookie, localStorage, sessionStorage, IndexedDB, the Cache Storage API, a service worker cache and the tab's name. It means nothing outside this site and is tied to no account, no profile and no person.
It exists so the page can show you that clearing one copy does not clear the rest. The Take it back section at the foot of the data page erases all of them and shows you, store by store, what actually went.
What the server remembers
Two things, because neither demonstration works otherwise. The first is the ETag identifier the server issues and a count of how often your browser hands it back, which is how server-side recognition without cookies is shown at all. The second is which CSS conditions your browser matched, without which the no-JavaScript fingerprint could be described but never demonstrated.
Both are a single entry in a map in the server's memory, capped at five thousand entries, pruned after twenty-four hours, and never written to disk. There is no database. Restarting the server forgets everyone, and it restarts on every deployment.
What the host sees
This site runs on Railway, which terminates TLS and produces ordinary access logs — address, path, timestamp, response code — as any web server does. The application neither reads nor retains them, but they exist, and claiming otherwise would be the kind of vagueness this site was built to argue against.
What is never done here
No analytics of any kind. No advertising or marketing tags. No third-party requests: the frame in the cross-site demonstration is this same server answering on a second hostname. No IP-geolocation lookup — your address is never sent anywhere to be turned into a place. No account, no email, no contact form, no newsletter. The tracker payloads shown on the data page are built in front of you and never sent.
Questions, or something here that does not match what the code does: open an issue. Last reviewed 13 September 2026.