Last changed 15 October 2026

Privacy policy

Snitch is a demonstration of what a website can learn from an ordinary visit, so it collects a great deal, on purpose, after asking. This page lists all of it: what is read, what is kept and for how long, who else receives any of it, and how to erase it. Every line was checked against the site's code on the date above.

The short version

• Nothing about you is read until you press Tell me everything about me at the door.
• After that it reads your machine, your connection, what you do on the page and, if your browser fills in its form, your name and contact details. It sends some of this to AI models and lookup services to write the page.
• Your details are kept for seven days after your last visit; the rest for at most ninety, most of it far less.
• One button on the door erases what the site holds about your machine and clears its cookies.
• Nothing is sold. Nothing is used to advertise to you. The site advertises itself, and puts no ad tag on any page.
• This page, the door and the site's other articles read nothing and set no cookie.

Who is responsible

AlphaVenture, Office No. 802, 8th Floor, Anum Empire Building PECHS Shahrah e Faisal, Jinnah Housing Society Karachi, 74200, Pakistan. For anything about your data or this page, write to hamad@alphaventure.com. "We" below means AlphaVenture.

Pages that read nothing

The door (/gate.php), this page, the terms and the articles — what a website can see, what autofill gives away, private windows and how the site is maintained — set no cookie, load nothing from another site and run no script, with one exception: on a phone, the door and /agent/ offer to send you this site's address for later, and only when you press that button do a few lines of script hand the address to your phone's share menu or copy it. Each article adds one to a daily count kept per page, per site you came from (its name only, such as a search engine's) and per kind of visitor (a person, or which kind of machine: a search engine's crawler, an AI assistant fetching the page, a link preview, a script and so on, guessed from the browser's name and from whether the request carries a header every current browser sends; neither is kept). No address, nothing else.

The door is counted the same way: one more each day when it is shown to someone who has not answered, and one more for whichever of its two buttons is pressed, filed by the word in the link you came by (such as hn or reddit) or, for a link without one, the name of the site you came from, or, if you came from one of this site's own articles, which one. As with the articles, a person is told from a machine by the browser's name and that one header, neither of which is kept; no address and nothing else about you goes in.

If the link you came by to the door or to an article carries a tag, the same day's count is also kept by the tag's words: where the link was put, what kind of link it is and the name of the post or advert, such as reddit/social/claudecode. Each word is kept only if it is one of a fixed list of words this site's own links use, and becomes other if it is not, so nothing typed into a link is stored as it was typed.

The door sets a cookie only when you press one of its buttons. If you arrived from another site, the name of that site is carried across the door in a cookie that is used once, so the demonstration knows where its visitors come from.

Like any web server, ours writes an access log of the requests it answers, including the network address they came from. It is used to run the server and to count visits: how many arrived by each page and each advert, and how far they got. Only the server's own counting tools read it, and they print totals; only those totals are ever published, never a line of the log or an address. The log is started afresh each week and the four weeks before it are kept, so a line is deleted between four and five weeks after it was written.

What the demonstration reads, once you agree

• Your machine. About fifty readings your browser gives any page without a prompt: screen size and pixel density, graphics chip, memory, processor count, battery level and charging, refresh rate, browser and operating system, colour scheme, motion preference, touch, fonts, time zone, connection speed, whether you block ads, whether you have visited before and when.
• Your connection. Your network address, which is looked up to find a city, a region, a country and an internet provider, and then the weather and the day's headlines there.
• What you do on the page. How far and how fast you scroll, which parts you reach and how long you stay, what you click, select and copy, and whether you open developer tools, print, right-click or open a second tab.
• Whatever your browser fills in. Near the end there is a form with one visible box. If your browser autofills it, the page receives what it filled: a name, and often an email address, a phone number, an employer and a home address. How that works.
• A public profile search, only if a name was filled in: the page looks for matching public LinkedIn profiles and shows you up to eight. If you pick one, that profile is read and written about.
• Google sign-in, only if you use it: Google sends us your name, email address, profile picture, your Google account's number and, for a work account, its domain.
• A song, only if you ask for one: it is written from the readings above.

To recognise your machine on a later visit, including in a private window, the site combines your network address, your browser's name and version, your graphics chip and your screen size into one scrambled key. Why those four.

What is kept, and for how long

Everything is kept on this site's own server, which we rent from Hetzner Online GmbH and which stands in Germany. Each item is deleted when it reaches its age; the clean-up runs every hour while the site is being visited. "From your last visit" means the clock starts again each time you come back.

• That you agreed. The date and the version of the door you saw, and nothing else. Ninety days.
• Your session. What you did on the page, and your details if they were captured, so a later visit can pick up where you left off. Ninety days from your last visit.
• Your details, if your browser filled in the form or you signed in with Google: what was filled in or what Google sent, with your network address, your browser's name and language, the readings from that visit, the profile you picked and the two paragraphs written about you. Filed under the key described above. Seven days from your last visit.
• Sentences written about you. Reused for up to four hours so the page does not rewrite itself on every scroll, then deleted within a day.
• The profile search. The public LinkedIn profiles found for the name, which may include other people with the same name. Thirty days.
• Your song. The words and the recording. Thirty days.
• Your place. What the lookup said about your network: city, region, country, provider, and the weather and headlines. Up to thirty days, filed under a scrambled form of the network, shared by everyone on it.
• Request limits. A count of the paid lookups made from your network today, in a file named after the first three parts of its address. Two days.
• Facts about products. What your browser's name and your phone's model code turned out to mean, shared by everyone with the same browser or phone. Thirty days.

The statistics, and what the agents see

For each visit to the demonstration the site keeps one row of statistics, so it can tell whether a change made things better. It holds no name, email, phone or address, no network address in any form, no recognition key, no browser string, no city and no provider. What it does hold is coarse: the kind of device, the browser family, a screen-size band, a band for how many times you have visited, which site you came from (its name) and the campaign word of the link if it had one (one of a fixed list: linkedin, x, reddit, hn, newsletter, shared for a link sent on with the button at the end of the demonstration, shared-verdict for a link sent on after saying whether the page's verdict was right (the link carries a random part that makes it unique; it is not kept), other; and for a link from one of this site's own ads, the platform with -paid and the ad's region, pk or na, as in linkedin-paid-pk, google-paid-na or reddit-paid-pk, and which of those ads, as one of the names we gave them, such as x-home-pk, or other), which page of this site you came in by (the demonstration itself, or one of these pages if you followed its link, as in /agent/), how far you scrolled, which parts you saw and for how long, which of the page's controls you clicked, how fast the page appeared and whether a script failed, and whether a name was captured (yes or no, never the name). A new random number is made for every page load, so two visits are not linked. These rows are kept without a time limit.

Two AI agents work on the site: one maintains it (how that works) and, since 5 October 2026, a second one runs its ads. They read these rows, the daily page counts, the totals counted from the access log and the advertising platforms' reports. They are not allowed to read anything on the list above, and do not; the pictures the first one publishes of the page are taken with made-up visitors.

Who else receives any of it

• AI models, through OpenRouter. The readings and what the page worked out from them, to write the page's sentences, and, once captured, your first or full name, city, employer and the profile you picked. For a song, also your street address. Your network address is not sent. The models are made by Google (Gemini, and Lyria for the music) and DeepSeek; OpenRouter passes each request to the company that runs the model.
• ipwho.is, a network-address lookup: your full network address, to find the city and provider. When it will not answer (it allows our server a thousand new lookups a day), the same address goes to ipinfo.io instead, and if that will not answer either, to freeipapi.com. Each gets only the address, and the answer is kept for the block of addresses it belongs to, not for you.
• Open-Meteo: the position of that city, for the weather.
• Google News: your country, for the headlines.
• userstack, a browser lookup: your browser's full name string, to tell what the device is.
• Apify, which runs the public LinkedIn profile search: the first and last name that was filled in, your country or the city that was filled in, and the employer if one was filled in. Only if a name was captured. The profile pictures it finds are fetched by our server, so your browser does not contact LinkedIn.
• Google Maps, from your browser: the street address, city and country that were filled in, to draw the place on a map. Only if your browser filled in a street address.
• X, LinkedIn or WhatsApp, only if you press one of the buttons under the page's verdict on you: that service opens in a new tab with a link to this site (and, for X and WhatsApp, the words in the box there), for you to post or send yourself. Nothing goes until you press, the page loads nothing from them, and you can still change or drop the words there.
• Google sign-in. Near the end the page loads Google's sign-in button from Google, so Google sees that visit as it would on any site that shows the button, and may set its own cookie. If you use it, Google sends us what is listed above.
• Google Analytics: the page's address, including the campaign tag of the link you came by; the name of the site you came from; which parts you reached, how far you scrolled and how long you stayed; clicks on the page's links and controls; a few coarse facts (screen-size band, visit-count band, returning or not, colour scheme, motion preference, touch); and script errors. Never your name or details. It sets its own cookies. As set in the studio's Analytics account, Google keeps event data for two months and user data for fourteen months, the second clock starting again whenever that browser comes back. The account is not linked to any Google Ads account, and Google signals, which joins visits to signed-in Google accounts, is off.
• Anthropic, whose model, Claude, both of the site's AI agents run on: what the agents read to do their work, which is the statistics, page counts, access-log totals and advertising reports described above. Nothing on the list of what the demonstration reads, and no network address.
• An ad-blocker check. To tell whether you block ads, the page asks two Google advertising addresses for nothing at all. No ad and no tag is loaded.

Each of these companies handles what it receives under its own policy. Nothing is sold to anyone.

The demonstration says a few words aloud: if it has your name, your first name when you leave its tab. It speaks only with a voice that runs on your own machine; if your browser offers none, it stays silent, so nothing it says is sent to a speech service.

Advertising

The site advertises itself to people in Pakistan and in the United States and Canada, on four platforms, with pictures and a short film: LinkedIn since 4 October 2026, Reddit since 5 October, X since 6 October, and Google, beside search results and as picture ads on YouTube, Gmail and Discover (every Google campaign is paused as this is written). AI agents write and run the ads: since 5 October a second agent, the ads desk, decides which ads run, who sees them and where the money goes, and the studio's own people work through the same services (the budgets and the figures).

The ads are aimed by what each platform offers advertisers, never by anything about this site's visitors: on LinkedIn by job, seniority, skills, job titles, industries, employers and schools; on Reddit by communities and keywords; on X by words people post or search for, and by resemblance to the followers of chosen public accounts; on Google by what is searched for and, for the picture ads, by the kinds of site Google says people visit. No list of this site's visitors goes to any platform, and nothing the demonstration reads is used to choose who sees an ad.

No page on this site carries an advertising tag from LinkedIn, Reddit, X or Google Ads: nothing reports your visit back to them for measuring ads or showing you more of them. An ad's link carries a tag naming the platform, the region and the ad, which the statistics keep as the words above. Platforms add marks of their own to the link. Google's (gclid, gbraid, wbraid) are carried across the door only if you press Tell me everything about me, are stored nowhere, and are read only by Google Analytics on the next page. The others, such as LinkedIn's li_fat_id, are not read by the site; they appear only in the access log, where they are counted. The platforms know you clicked their ad, under their own policies.

Cookies and browser storage

Set by this site:

• sb_consent — that you agreed, and when. Ninety days.
• PHPSESSID — your session. Ninety days from your last visit.
• env — the readings, sent with each request so the page can write about them. Until you close the browser.
• sb_seen — that a name was captured in this browser. It holds no name. Ninety days.
• sb_fresh and sb_from — set when you pass the door, removed on the next page: one marks the first page after agreeing, the other carries the name of the site you came from.

Set by Google, on the demonstration only: _ga and _ga_7HNZPSZ8CZ (Analytics), and g_state if you close Google's sign-in prompt. Google decides how long they last.

The demonstration also keeps a few counts in your browser's own storage, which stays on your machine: how many visits and page loads, when you first and last came, lifetime totals of clicks, selections and copies, your deepest scroll and reading pace, and a sound setting for the song.

How to erase it

Press Erase what you have on the door. It deletes your details, your song, the profile search and the sentences written about you, the record that you agreed and your session; expires this site's cookies and Google Analytics' cookies; asks your browser to clear the counts in its storage; and then shows you how many items it removed. Withdrawing your agreement and erasing are the same button.

What it does not remove: the statistics rows and page counts, which hold nothing that identifies you; the request-limit counts and the place lookup for your network, which belong to everyone on it and expire by themselves; anything Google Analytics already recorded; and what your browser itself remembers, such as its autofill entries. If your browser ignores the request to clear its storage, clear this site's data in its settings. If you cannot use the button, write to us and we will do it.

When this page changes

Whenever the site starts reading, sending or keeping something differently, this page changes in the same release and its date moves. If the change is a new kind of reading, the door asks you again.

The demonstration

That is everything it does with what it reads. The door says the short version before anything is read.

Written on 4 October 2026 by the AI agent that maintains this site (how that works), from the site's own code, and last brought up to date on 15 October 2026 from the code, the advertising services and the server's settings. No lawyer has read it yet. Questions and requests to hamad@alphaventure.com.