Browser monitoring preferences

What may be collected

When enabled, sampled public pages send a limited report: page category and language, approximate viewport size and navigation timing, visibility, and the browser-reported WebDriver flag. The server adds allowlisted HTTP fields. These values do not prove CDP control or identify an agent.

The report does not include URLs, queries, referrers, cookies, form contents, keystrokes, account or visitor identifiers, or raw IP addresses. Account, editorial, search and form pages are excluded. Automatic checks log two diagnostic errors to observe inspector serialization and briefly create an isolated frame and worker. Only result counts, availability, comparison field names, and context WebDriver flags are reported; raw property values stay in your browser. No page-function wrappers or input listeners run.

Only authorized administrators can inspect reports, subject to expiry and bounded storage. If a trusted network ingress is configured, a daily cryptographic transformation of the IP is used only in shared rate-limit buckets; it is not added to the report. Global Privacy Control and Do Not Track preferences are respected.

Opt-in browser signal lab

The “Am I a bot?” page has one checkbox approving all checks, research storage, and remembering this browser. It is unchecked on a first visit; only an existing valid v5 grant restores approval. Checking it runs nothing: you must press “Run all checks and save.” It includes local signals, Canvas/fonts, WebGL, reference lookup, HTTPS/TLS, and WebRTC/STUN. No account is required.

Reference lookup sends the Canvas SHA-256 to the main API, without pixels or images; the lookup itself is not stored. capture.parallaxsee.com temporarily processes the IP, ClientHello, JA3/JA4, TLS, and a signed bounded HTTP/2 first flight. WebRTC and the collector’s owned STUN service may reveal local interfaces, .local names, and additional public addresses; no camera or microphone access is requested. Candidates are sent to the API for comparison. This processing is neither local nor anonymous.

After the checks finish, your approval authorizes automatic saving of available observations: normalized signals, coverage, bounded timings, rendering and transport profiles, and route summaries. Failures remain limitations. Exact IPs, literal candidates, ports, and .local names are removed from the saved summary. Fingerprints become keyed study digests; OS, browser, and device categories are announced, not verified. The copy excludes accounts, cookies, URLs, referrers, typed text, and coordinates. It can still link similar configurations: it is not anonymous. It expires within 90 days. You can cancel before saving or withdraw afterward using the receipt. Your remembered history also lets you withdraw its saved samples.

A random token in this site's browser storage links consented runs even when Canvas or other settings change. The server retains a hash of the token, not the secret. Returning may load your history, but measurements require pressing Run. Comparisons separate changes, missing measurements, and incompatible versions. This recognizes remembered browser storage, not a person or verified device; fingerprints or IPs never recover a lost association.

History has a fixed expiry of up to 90 days and 100 run slots; capacity limits may remove data sooner. You can delete one run or all history, which revokes access. Forget this browser removes only the local token, not server samples. Clearing site data may break the association. The recovery file, also included in the full JSON download, is private: it permits reading, appending to, and deleting history. Canvas reference lookup counts at most one recent eligible sample per history and excludes yours; histories do not equal unique devices.

Consented phone references

The “Phone / Chrome reference” section has separate approval, initially unchecked. It collects six test pixel samples, hashes, font and display metrics, browser capabilities, WebGL, allowlisted headers, and test events without typed text. Finishing privately saves them for administrator review for up to 90 days. Importing an earlier JSON requires explicit approval too. These detailed data can link configurations and are not anonymous. They are separate from research history and do not prove phone identity.

A capture ID and secret withdrawal receipt are kept in this browser. Use “Captures saved from this browser” to withdraw them, or give the ID to an administrator. Resetting a capture or clearing site data does not delete server copies. Captures cannot be publicly retrieved. Storage holds 512 captures up to 8 MiB each and rejects new uploads when full; live captures are not replaced. Infrastructure access logs may include IP addresses.