{
 "$comment": "What this host records about a request, what it publishes, and what it does not do. Generated by surfaces/ai-crawler-index/build.py on every rebuild; /privacy.html is the same document for people.",
 "name": "AI Crawler Index",
 "canonical": "https://www.pathwren.workers.dev/privacy.json",
 "human_readable": "https://www.pathwren.workers.dev/privacy.html",
 "terms": "https://www.pathwren.workers.dev/terms.json",
 "generated_at": "2026-09-01T13:57:24+00:00",
 "summary": "One log row per request, taken at the edge before anything is served. No cookies, no JavaScript, no third-party analytics, no ad networks, no data sold or shared. Your address is hashed with a secret salt and the raw value is never stored and never served.",
 "collected_per_request": [
  "timestamp",
  "path",
  "query string",
  "user-agent",
  "referer",
  "accept header",
  "HTTP status",
  "bytes served",
  "surface and channel the URL resolved to",
  "salted SHA-256 hash of the IP address, truncated to 16 hex characters"
 ],
 "not_collected": [
  "raw IP addresses (hashed before storage, never written and never served)",
  "cookies — none are set, by anything here",
  "any JavaScript-derived signal: the pages carry none",
  "device fingerprints",
  "anything typed by a visitor: there are no forms and no inputs",
  "names, emails or accounts — there are no accounts"
 ],
 "how_it_is_collected": "A Cloudflare Worker runs before the static assets on every request and writes the row itself. There is no JavaScript beacon on the pages, so curl, agents and crawlers are counted exactly like browsers — and a client that runs no JavaScript is not invisible to it.",
 "ip_handling": {
  "stored": "SHA-256 of (secret salt + address), first 16 hex characters",
  "raw_address_stored": false,
  "raw_address_served": false,
  "salt": "one secret, shared with this project's own collector so that one client hitting both hosts counts as one client",
  "salt_rotated_on_a_schedule": false,
  "what_that_means": "Until the salt changes, the same address produces the same hash, so repeat visits are linkable to each other — that is what the visit counts on /bot/ are built from. The hash is not reversible to an address without the salt, and neither the salt nor the hash is published."
 },
 "published": {
  "aggregate": "https://www.pathwren.workers.dev/stats.json — external counts only, this project's own traffic excluded",
  "per_client_pages": "https://www.pathwren.workers.dev/bot/ — one page per client that has asked this host for something: the exact user-agent strings, first and last seen, how many distinct addresses (the number, never a value), the paths in the order they were asked for, status codes, and what it asked for that did not exist",
  "never_published": [
   "an IP address",
   "an address hash",
   "any link between two different clients"
  ],
  "why_the_client_pages_exist": "The machines that inspect other machines — registry probes, trust scanners, liveness checkers — are documented nowhere on the web. This host has them first-hand and dated, so it publishes what it measured about each, and nothing about intent.",
  "removal": "Ask at pathwren@tutamail.com and the page for your client is removed."
 },
 "shared_with": {
  "third_parties": [],
  "analytics_vendors": [],
  "advertising_networks": [],
  "data_sold": false,
  "infrastructure": "Cloudflare hosts the worker, the static assets and the database the rows are written to, and therefore handles the request as any host does.",
  "raw_rows": "exported only to this project's own store, over an authenticated endpoint, because the rows carry other visitors' user-agents and address hashes"
 },
 "retention": {
  "scheduled_deletion": false,
  "statement": "There is no automatic deletion configured today. Rows stay in the edge database and in this project's copy of it. If that changes, this document changes with it — it is regenerated on every rebuild."
 },
 "not_recorded_at_all": [
  "/health",
  "the authenticated export endpoints"
 ],
 "cookies": {
  "set": false,
  "read": false,
  "consent_banner": "none, because there is nothing to consent to"
 },
 "your_options": [
  "Send whatever user-agent you like: nothing here is gated on it.",
  "Ask for a client page to be removed and it will be.",
  "robots.txt governs what a crawler fetches, not what a server logs — every request that arrives is recorded, including the one that fetched this file."
 ],
 "contact": {
  "email": "pathwren@tutamail.com",
  "url": "https://www.pathwren.workers.dev/about.html",
  "accepts": "removal requests, corrections, questions about the log"
 },
 "asked_for_by": {
  "user_agent": "Mozilla/5.0 (compatible; APIEvangelist/1.0)",
  "asked_at": "2026-09-01T12:06:53+00:00",
  "was_answered_then": 404,
  "paths": [
   "/terms.html",
   "/privacy.html"
  ],
  "context": "44 requests over two walks, 11:56:42Z-12:06:54Z, from one address; these two paths were the only documents of the second walk that did not exist",
  "why_those_filenames": "APIs.json 1.0 property types TermsOfService and PrivacyPolicy are conventionally these paths. Both are now declared in /apis.json, so the next validator follows a link instead of guessing a filename.",
  "full_record": "https://www.pathwren.workers.dev/bot/apievangelist.html"
 }
}