What leaves the app. What does not.

01 · Local exclusion

Human requests are excluded before transport.

The collector matches reviewed agent user-agent tokens inside the host app. Ordinary browser requests, static assets and React Server Component payloads do not emit events or collector contact.

No IP address, full user-agent string, query string, cookie, other request header, request body or response body is sent. The collector cannot show agents that use an ordinary browser identity.

02 · Agent event

The unit is requests from identifiable agents.

A live-fetch event contains bounded project and request identifiers, time, classified agent and kind, rules version, a reviewed claim, verification evidence and a sanitised path without query or fragment. The claim and the verification result—verified, failed or unavailable—stay separate.

Live fetches are itemised. Crawlers and failed live claims are counted per minute without individual paths. A request does not prove human initiation, intent, reading or comprehension.

03 · Storage and current status

The running service is a founder pilot.

The pilot backend runs on a Hetzner VPS in Falkenstein, Germany. The same Docker Compose distribution supports self-hosting. Its dashboard is restricted to the operator; customer accounts are not open.

Repository defaults are 14 days for raw request and response records and 15 calendar months for rollups and saved handling. The founder worker deployed the current per-project raw and aggregate enforcement on 22 September without changing those settings. Cleanup runs at startup and on each worker pass; it requires a running worker and an available database, so expiry is not synchronous with ingest.

Installed collectors use bundled vendor evidence. Signed hosted evidence refresh is implemented but has no production trust root, public feed or opted-in collector. The public agent reads route is also opt-in and is currently unconnected.

04 · Legal availability

No customer legal documents are published yet.

Terms of service, a customer privacy policy, DPA/AVV and a dated sub-processor page remain launch work. This page does not replace them or make a compliance assurance. See the current legal-document status before relying on any customer-facing commitment.