# Privacy

> What flexlayout-dash stores about a visit, what it does not store, and where the numbers go — described from the code that does it.

**Site index:** [https://flexlayout.2plot.dev/llms.txt](https://flexlayout.2plot.dev/llms.txt) — every page on this site, as Markdown.  
**Network index:** [https://2plot.dev/llms.txt](https://2plot.dev/llms.txt) — The 2plot network; start here to discover sibling sites.  
**Sibling sites:** 13 more in The 2plot network — listed in the site index above.  
**Sitemap:** https://flexlayout.2plot.dev/sitemap.xml  


This page describes what the code in this repository actually does. Each
claim below corresponds to something readable in `lib/analytics_tracker.py`,
and the test suite holds the two together.

## What is stored about a visit

Every request that is not network machinery records one row:

- the **time** of the request;
- the **path** requested;
- a **device type** (desktop, mobile, tablet, bot);
- the **User-Agent** string your browser or client sent;
- a **visitor key** — a keyed one-way hash of your network address and
  User-Agent, truncated to 16 characters, used to tell one visitor from
  another within the retention window;
- a **location**, if and only if the network edge in front of this site sent
  one (see below).

Crawler rows additionally carry the vendor identity the classifier
determined — which bot it was, and whether it verified.

## What is NOT stored

- **Your IP address.** It is read from the request so the site can tell one
  visitor from another and so the edge's country header can be matched to it,
  and then it is reduced to the visitor key and discarded. It is never
  written to disk.
- **Anything from a third-party lookup service.** Earlier versions of this
  site sent visitor addresses to a geolocation API to turn them into
  countries. That code was removed — not disabled — in the 1.6.44 sync. This
  app now makes no outbound request about you of any kind.
- **Cookies for analytics.** The visitor key is computed per request from
  what your client already sent. Nothing is stored in your browser to track
  you.

## Where location comes from

From the network edge, or not at all. Cloudflare sits in front of this site
and adds headers describing where a request entered its network:
`CF-IPCountry` always, and `CF-IPCity`, `CF-Region` and `CF-Region-Code` when
the zone is configured to send them. Whatever arrives is stored; whatever
does not is simply absent. There is no lookup and no fallback to one, so a
visit with no location headers carries no location at all rather than a
guessed one.

You can see which of those headers this host is actually receiving — they are
listed in the `geo.headers_seen` field of
[https://flexlayout.2plot.dev/healthz](https://flexlayout.2plot.dev/healthz).

## Network machinery is counted nowhere

The 2plot network's own traffic — health checks, deploy batteries, link
audits — carries a marker in its User-Agent and is dropped before anything is
recorded, on both the page table and the document-read table. It is not in
these numbers, by design.

## How long it is kept, and where it goes

Rows are pruned after **45 days** and the visit table is capped
at **20,000 rows**. A daily summary — counts by day, by page, by
country, by crawler vendor — is sent to the 2plot network hub. The summary
carries no visitor keys, no addresses and no User-Agent strings: it is counts.

## Questions

The [Discord](https://discord.gg/e5s5uHWUHH), or an issue on
[the repository](https://github.com/pip-install-python/dash-flex-layout).