What is collected when you browse
The site runs first-party telemetry. It is sent to an API operated for this site, not to a third-party analytics service, and no advertising or tracking pixels are used.
- Pages and navigation: the pages you view, page titles, the referring page, campaign parameters in the link you followed, time on page, and scroll depth.
- Interaction counts: how many clicks, key presses, scrolls, and focus changes happen, and the visible text of links and buttons you click (up to 120 characters). The contents of form fields are never read; password and hidden fields are ignored entirely.
- Browser and device characteristics: user agent, languages, platform, screen and window size, pixel density, touch support, CPU core and memory buckets, time zone, and signals that indicate automation (for example a webdriver flag).
- Changes other software makes to the page: when a browser extension adds files or elements to the page, its identifier, the file paths it loaded and the kinds of elements it added; custom elements added after the page loaded; and the names (not values) of attributes on the page's root elements. This is read only from the page itself. The site never probes for or lists the extensions you have installed.
- Network information: your IP address, network operator (ASN), approximate location derived from the IP by Cloudflare (country, region, city), connection details such as TLS version and round-trip time, and request headers with cookies and authorization removed.
This is used to understand how different kinds of visitors use the site, to tell people, AI agents, and automated traffic apart, and to keep the site secure. It is not used to build advertising profiles, and it is not sold.
Cookies and local storage
-
ac_vid: a random visitor identifier, kept for 400 days and renewed on each visit. It is shared by caruana.me and its subdomains (such as util.caruana.me), so a visit to either is recognised as the same visitor. No other site can read it. -
ac_sid: a random session identifier that expires after 30 minutes without activity. - Browser storage holds the current page view and where your visit started (first referrer and landing page). No visitor identifier is kept in browser storage.
Both cookies are first-party, set by this site's server, and cannot be read by scripts on the page. Each page also carries a random identifier that links the page to the request that served it. If you block cookies or JavaScript, the site still works. Requests are still recorded at the server, and visits from clients without cookies may be grouped by network and browser characteristics, with a recorded confidence.
Taking part in the experiment
This site is an experiment in how people, AI agents, and automated clients use the web. Using the site means agreeing to take part, as described on this page. Do Not Track and Global Privacy Control signals are recorded as part of what your browser reports, but they do not change what is collected. Requests from agents and automated clients, including requests for the Markdown versions of pages, are recorded the same way.
When the site recognises a visit as coming from an AI agent, it may add a short note addressed to the agent, inviting it or the person it is working with to ask bc. a question. People browsing never see this note. The site records when the note is shown and which version was shown, to learn which wording agents respond to.
What you choose to send
If you send a private reply, start a Telegram or WhatsApp conversation, or join the mailing list, the details you submit (such as your email address, phone number or handle, name, and message context) are stored to carry out that request. Email addresses are checked for a valid mail domain, and mailing-list subscribers are added to the mailing-list provider.
AI agents can ask bc. a question through the site’s agent endpoint. The question, any name the agent gives, any contact details it chooses to leave, and its later replies are stored as plain text so bc. can read and answer them.
Who processes it
- Cloudflare hosts the site and the API and delivers every request.
- Resend sends email and manages mailing-list subscriptions.
- Telegram and WhatsApp carry conversations you start on those services, under their own policies.
Telemetry and contact data are stored in a database on infrastructure operated for this site.
How long it is kept
- Raw IP addresses are deleted 90 days after your last visit; a salted hash is kept.
- Other telemetry, and what is worked out from it, is deleted after 24 months.
- Contact details are kept until you ask for them to be removed or unsubscribe.
Your choices
You can ask to see, correct, or delete information about you, or unsubscribe from the mailing list at any time using the link in any email. Write to [email protected].
This page may change as the site changes. The effective date above shows the latest version.