Traffic measurement privacy

u64.cam runs a transparent experiment to understand how people, crawlers, feed readers, and AI agents discover public pages. Page requests pass through Cloudflare; selected request metadata is written to a private Cloudflare Analytics Engine dataset for up to three months. Analytics Engine may sample high-volume traffic, so reported totals are estimates calculated with Cloudflare's sample interval.

Recorded

• Path without its query string, HTTP method, response status, and broad route category.
• Truncated User-Agent, Accept header, primary accepted language, and request purpose header.
• Referrer origin only; referrer paths and query strings are discarded.
• Country, Cloudflare data center, ASN and network organization, HTTP protocol, and TLS version.
• Cloudflare verified-bot, signed-agent, and bot-score signals when the account plan provides them.

Not recorded by this experiment

• Raw IP addresses, cookies, URL query strings, or an intentionally generated stable visitor identifier.
• Guestbook form bodies, names, notes, or other submitted fields.
• City, postal code, latitude/longitude, TLS fingerprints, or browser storage.

Interpretation limits

The fields are used to compare discovery channels such as normal pages,robots.txt, sitemaps,llms.txt, canary pages, and theguestbook. User-Agent, referrer, Accept, language, and purpose headers are client-controlled and may be spoofed. Country, network, and bot metadata are hints rather than proof of a scraper's identity. A canary hit proves only that the URL was fetched, not why or by whom.

Although the experiment creates no cookie or stable visitor ID, the combination of User-Agent and coarse network/request metadata can still be quasi-identifying for a short period. The data is not used to follow a visitor across unrelated sites.

Separate GoatCounter measurement

Normal HTML pages also load the privacy-focused GoatCounter pageview script, and some canary pages contain a GoatCounter image pixel. This client-side measurement is separate from the Cloudflare edge dataset and may miss clients that do not execute JavaScript or load images. SeeGoatCounter's privacy documentation.