---
title: "Privacy — AI Crawler Index"
description: "One log row per request, taken at the edge: time, path, user-agent, referer, accept, status, bytes and a salted hash of your address. No cookies, no JavaScript, no third-party analytics. Machine-readable at /privacy.json."
canonical: "https://www.pathwren.workers.dev/privacy.html"
url: "https://www.pathwren.workers.dev/privacy.md"
format: "markdown"
source: "the bytes of /privacy.html, in the build that wrote the page"
generator: "surfaces/ai-crawler-index/build.py"
generated: "2026-09-03T07:55:35+00:00"
license: "CC0-1.0"
---

# Privacy

> One log row per request, taken at the edge: time, path, user-agent, referer, accept, status, bytes and a salted hash of your address. No cookies, no JavaScript, no third-party analytics. Machine-readable at /privacy.json.

**What is kept about this request.** One row, written by the worker before
anything was served: the time, the path, the query string, your user-agent, the referer, the
accept header, the status code, the bytes sent, and a *salted SHA-256 hash* of your IP
address, truncated to 16 hex characters. That is the whole row. There are no cookies, no
JavaScript, no third-party analytics, no ad networks, and nothing is sold or shared.

Machine-readable copy: [/privacy.json](https://www.pathwren.workers.dev/privacy.json) ·
terms of use: [/terms.html](https://www.pathwren.workers.dev/terms.html) ·
public aggregate: [/stats.json](https://www.pathwren.workers.dev/stats.json)

## Your address

The raw address is never written to the log and never served. It is hashed with a secret
salt first. The salt is **not** rotated on a schedule, and saying so matters: until
it changes, the same address yields the same hash, so repeat visits are linkable to each other
— that is exactly what the visit counts on the client pages are built from. The hash is not
reversible to an address without the salt, and neither the salt nor the hash is ever
published.

## What is published, and what never is

Two things are public. [/stats.json](https://www.pathwren.workers.dev/stats.json) carries aggregate counts, with
this project's own traffic excluded. And [/bot/](https://www.pathwren.workers.dev/bot/) carries one page per client
that has asked this host for something: the exact user-agent strings, first and last seen, how
many distinct addresses it came from — the number, never a value — the paths it asked for in
order, the status codes it got, and what it asked for that did not exist.

Never published: an IP address, an address hash, or any link drawn between two different
clients. The raw rows sit behind a token, not to hide the numbers but because they carry other
visitors' user-agents.

Those pages exist because the machines that inspect other machines — registry probes, trust
scanners, liveness checkers — are documented nowhere else, and this host has them first-hand
and dated. If you operate one and would rather not have a page, ask at
`pathwren@tutamail.com` and it will be removed.

## Retention

There is no automatic deletion configured today, and this page will not claim one it does
not run. Rows stay in the edge database and in this project's copy of it. If that changes,
this document changes with it: it is regenerated on every rebuild.

## If you are a person

The same single row is recorded, and nothing else. No cookies to refuse, no consent banner,
no fingerprinting, no scripts of any kind — every page here works with JavaScript switched
off, because most of the clients that read it never had it. `/health` and the
authenticated export endpoints are the only paths not recorded at all: this project's own
control channel must not keep its own numbers warm.

## One thing that is often assumed and is not true

`robots.txt` governs what a crawler *fetches*. It does not govern what a
server *logs*. Every request that arrives here is recorded, including the one that
fetched this file.

## Why this page exists

A directory crawler calling itself
`Mozilla/5.0 (compatible; APIEvangelist/1.0)` asked for `/privacy.html`
and `/terms.html` at 2026-09-01 12:06:53Z and got 404 on both — the only two
documents of that walk which did not exist. Its whole visit is public at
[/bot/apievangelist.html](https://www.pathwren.workers.dev/bot/apievangelist.html), which is itself an example of
everything described above.

## Sitemap

- [Full sitemap (XML)](https://www.pathwren.workers.dev/sitemap.xml) — every page, with dates
- [Full sitemap (markdown)](https://www.pathwren.workers.dev/sitemap.md) — the same map, readable
- [llms.txt](https://www.pathwren.workers.dev/llms.txt) — the whole host in one text file
- [documents.json](https://www.pathwren.workers.dev/documents.json) — every document, with its ETag
- [A2A agents](https://www.pathwren.workers.dev/a2a.html)
- [About and method](https://www.pathwren.workers.dev/about.html)
- [API](https://www.pathwren.workers.dev/api.html)
- [Changelog](https://www.pathwren.workers.dev/changelog.html)
- [Compliance](https://www.pathwren.workers.dev/compliance)
- [Contact](https://www.pathwren.workers.dev/contact)
- [Impressum · Anbieterkennzeichnung](https://www.pathwren.workers.dev/impressum)
- [AI Crawler Index](https://www.pathwren.workers.dev/index.html)
- [No model runs here](https://www.pathwren.workers.dev/inference.html)
- [Legal](https://www.pathwren.workers.dev/legal)
- [MCP server](https://www.pathwren.workers.dev/mcp-doctor.html)
- [MCP server](https://www.pathwren.workers.dev/mcp-lint.html)
- [MCP server](https://www.pathwren.workers.dev/mcp-netcheck.html)
- [MCP server](https://www.pathwren.workers.dev/mcp-robots.html)
- [MCP transport: the GET and HEAD leg](https://www.pathwren.workers.dev/mcp-transport.html)
- [MCP server](https://www.pathwren.workers.dev/mcp-triage.html)
- [MCP server](https://www.pathwren.workers.dev/mcp.html)
- [Packages](https://www.pathwren.workers.dev/packages.html)
- [Pricing](https://www.pathwren.workers.dev/pricing)
- [Privacy](https://www.pathwren.workers.dev/privacy.html)
- [API reference](https://www.pathwren.workers.dev/reference)
- [Access, keys and sign-up](https://www.pathwren.workers.dev/register)
- [Security posture](https://www.pathwren.workers.dev/security.html)
- [Upstream status](https://www.pathwren.workers.dev/status.html)
- [Terms of use](https://www.pathwren.workers.dev/terms.html)
- [Trust](https://www.pathwren.workers.dev/trust)

## Machine copies of this page

- [HTML (canonical)](https://www.pathwren.workers.dev/privacy.html)
- [JSON](https://www.pathwren.workers.dev/privacy.json)
- [Markdown](https://www.pathwren.workers.dev/privacy.md) — this document

This document is a markdown rendering of [https://www.pathwren.workers.dev/privacy.html](https://www.pathwren.workers.dev/privacy.html), generated from that page's own bytes in the same build. The HTML page is canonical.