Privacy

The short version

No accounts, no sign-in, and no cookies set by us. We do not store IP addresses or browser strings. We count visits and API use in aggregate to see whether the site is useful.

What we log

• Aggregate counters. The server behind our API, search, export and MCP endpoints keeps counts of which endpoint or tool was used, the HTTP status, and a coarse class of client (for example "browser", "ai-agent" or a known crawler name). It does not store raw IP addresses, full user-agent strings, request bodies or search text.
• Daily rotating hash. To count a visit once, we derive a short identifier from the network address and client string with a secret salt that changes every day. The salt is deleted after about a day, so the identifier cannot be linked across days or turned back into an address. The identifier is kept in operational logs for a few days.
• Network operator. We record the autonomous-system number and organisation name of the connecting network (for example a cloud provider or an ISP), to tell data-centre bots from people. That describes a network, not a person.
• Rate limiting. The free API limits calls per day. The limit counter is keyed by a keyed hash of the address, not the address, and expires within about a day.
• Campaign tags. If a link carries ?ref=name, the page sends one request that counts that tag. Nothing else is sent.
• Page analytics. The site is served through Cloudflare, which runs Cloudflare Web Analytics for us. Cloudflare describes it as privacy-first: no cookies and no cross-site tracking. It reports page views, referring site, country and device type in aggregate. Cloudflare, as our host, also processes visitor IP addresses to deliver the site, under its own policy.

On your device

The site remembers your light or dark theme choice in your browser's local storage, and, after a checkout, the confirmation page keeps your purchase details in that tab's session storage, which clears when the tab closes. Neither is sent to us from storage.

Payments

Checkout is handled by Stripe. We never see card details. Stripe tells us the payment details needed to deliver what was bought (such as an email address), and Stripe may set its own cookies on its pages. If you pay with a crypto wallet through the x402 protocol, the payment is verified and settled by a payment facilitator; we keep only the information needed to deliver the purchase and to avoid charging twice.

Email and the newsletter

If you write to us, the message is kept in the inbox below as ordinary correspondence. The newsletter is sent through Buttondown, which stores subscriber emails; each issue has an unsubscribe link.

The data about businesses

The leaderboard lists businesses and publicly stated figures from public sources, with links to each source. To correct or remove an entry, write to us.

Your requests

To ask what we hold about you, or to have something corrected or deleted, email thenine@mail.grokbot.com. Given the design above we normally hold little or nothing that identifies you. This page may change; the effective date is at the top.