Search privacy
Privacy policy / the public observatory
Updated October 3, 2026.
The public observatory lets anyone explore and download observations of braigetori's public small-world index and privacy-limited aggregate search signals. It describes what our crawlers have observed, not individual visitors or the size of a community.
Public index observations
We retain counts of indexed URLs, distinct content hashes, duplicate copies, server addresses, fetch failures and recently fetched/changed resources. Daily server histories, bounded title-word samples and sampled published connections help show how indexed coverage changes. Server addresses and sampled words come from indexed public resources. These observations are publicly accessible through the console, its report API and exports.
Hourly world observations are retained for 90 days. Last-observed daily world summaries are retained for 730 days. Daily server, title-word and sampled-link records are retained for 90 days. Historical observations begin when collected; earlier history is not invented. Current-day index snapshots can be updated as new observations arrive. The analytics store has a 512 MiB budget and collection can pause when its storage or processing limits are reached.
Aggregate search signals
Search analytics receive selected worlds, HTTPS or Gemini, coarse result outcome and daily counts from a limited reviewed vocabulary (for example music, art or programming). Complete search phrases, unknown words, URLs, email addresses, numeric input and search filters are not retained. A search with no reviewed word can contribute only a private aggregate request count.
The public console publishes reviewed-word cells only after the UTC day has finished and at least five events were received for that word, world selection, channel and result outcome. Completed days are published once and do not expose running counts. Private request totals and small cells are not included in public reports. Five events do not mean five different people. Bots and repeated requests may contribute. Suppression is not differential privacy or a guarantee of anonymity; this is best-effort aggregate measurement, not a traffic census.
Search aggregates, including published cells, expire from our store after 30 days. Public visitors can download or retain their own copies; their copies are not controlled by our retention schedule.
No visitor IPs, cookies, user agents, client certificates, locations or reader form input enter search analytics. There are no visitor profiles, unique-user counts, click histories or fingerprints in this collection. HTTPS honours DNT: 1 and Sec-GPC: 1 for these analytics. Native Gemini has no equivalent request headers. Search works when the optional collector is unavailable. No search demand is automatically sent to AI agents.
Organizing public search results
Useful first separates likely placeholders, thin files, routine logs, opaque source-history files and repeated copies from other matches. More matches and All matches retain those files, subject to the same safety warnings and blocks as every view. Labels are estimates, not judgments about an author or viewpoint. Old references, short answers and creative writing can be useful.
A scheduled local model reviews small batches of already indexed public document titles and text excerpts on this server. It receives no visitor search phrases, locations, reader inputs, email or private files. The reviewer has no browsing or file tools, and sends no document text to an AI provider. Cached classifications are tied to the content version and are reused until it changes. Uncertain judgments preserve ordinary results; a proposed demotion requires two agreeing review passes, with additional protection for concise and creative content. Searches themselves make no model requests. Earlier cached reviews may have been produced by the operator's subscription tools before the switch to local review.
Embedded Gemini reader
With JavaScript enabled, a Gemini client runs in your browser using OpenSSL compiled to WebAssembly. A restricted WebSocket transport carries Gemini TLS between your tab and the capsule. The transport sees the destination hostname, port, network addresses, timing and encrypted traffic sizes, but does not terminate Gemini TLS or record page URLs, page content, entered answers or client keys. The capsule sees the transport server's address. The website supplies the client code; the website and your browser remain part of the trust boundary.
Sharing a find is optional. Email sharing opens a draft in your own mail app; braigetori does not send it or collect recipients. The discovery link contains the current public page address (including ordinary query values) in its URL fragment, which is not sent with the homepage request. While a shareable public page is open in the reader, the address bar shows the same fragment, so copying the address or using your browser's share button shares that page; it is removed when the reader closes and is never sent to braigetori. The recipient’s reader opens that address using its usual connection and safety checks. Shared links do not contain private prompt answers, client keys, browsing history or safety consent. Private-input responses cannot be shared. A link opens a live page; it cannot transfer a sign-in, private session or game state. Email providers and anyone with the link can read its destination.
Gemini server public-key fingerprints and optional temporary client identities stay in the current tab's memory. Temporary identities expire after one hour or on page reload/closure. They are not recoverable permanent accounts. Back history holds bounded completed pages in tab memory, and is cleared when the reader closes. The four-world browser's bookmarks, and its trail of recent pages if you turn that on, are kept in your own browser's storage and are never sent to braigetori. The trail is off until you turn it on, and turning it off erases it. Clearing this site's data in your browser removes both. Private input is masked and is not retained in the reader address or Back/Reload history. The destination can retain what you send or echo it in its own response. Downloaded files are saved by your browser only when requested; temporary download objects are released when their reader history is discarded. Use Forget in Connection details to discard the tab's identities and remembered server keys.
The separate script-free Gemini relay and the Gopher, Spartan and Nex readers process remote requests on the server. Their ordinary input passes through that relay. They respect applicable capsule relay policies. Search analytics do not receive either reader's content or inputs. Hashed connection-rate keys and concurrency limits use bounded, short-lived server memory; no reader traffic is written to an index or request log by the application.
Content safety screening
Local text rules and the scheduled Qwen model assign content warnings and precautionary blocks to public indexed text. Safety decisions, content fingerprints and operator corrections are stored separately from the source index. Warning acknowledgments use per-resource URL tokens, not visitor profiles, accounts or tracking cookies. They do not verify age. Public safety notices and a correction contact are available at /safety.
The embedded reader checks destination paths, without query/input values, against the site's safety decisions. Those safety requests are not logged by the application. Decrypted text is additionally checked in the browser and is not uploaded for AI review. Images can be checked with a self-hosted MobileNet model in a browser worker; browser images are not uploaded to a provider or to this website for classification. The inspected server reader can check PNG/JPEG bytes in a separate local image worker. That worker has no external network, keeps no images on disk and exits when idle. Images classified as explicit or strongly sexual are blocked before preview/download; temporary copies are discarded and matching pending server downloads are deleted. Only bounded, temporary text/hash notices remain in RAM. The ordinary server download cache holds accepted files in RAM for up to five minutes, never in an image archive. Browser copies already downloaded or displayed elsewhere cannot be recalled. Unsupported, animated, failed or unreviewed media retain an explicit unscreened-file warning. No classifier certifies age, consent, legality or suitability for children.
User reports are handled through the existing contact mailbox. Send a URL and non-graphic explanation only, never suspected illegal images or attachments. Reports are reviewed by the operator and are not automatically treated as proven violations. No automated report to authorities or external safety service is made by these classifiers.
Safety labels, blocks and corrections
Public safety and local-model measurements
The observatory also publishes aggregate histories of stored safety-label categories, rule/model/operator sources, review coverage, scan freshness, queued content counts and ages, and dated safety actions. These counts describe retained scanner records and recorded actions, not people, confirmed offences, model accuracy or every currently indexed page. Flagged URLs, hosts, document text, images, content fingerprints and private operator notes are not included in these datasets. Hourly safety snapshots are retained for 90 days; last-observed daily safety snapshots and aggregate action history for 730 days.
The background text worker records daily numeric totals by run outcome: runs, document outcomes, inference attempts and failures, runtime-reported token counts, elapsed/CPU time and peak runtime memory. These measurements contain no prompts, document excerpts, answers, batch identifiers or visitor input. Measurements begin when this instrumentation is installed; earlier usage is not reconstructed. Text-model daily usage is retained for 180 days; current-day background-work counts can change.
Server image screening records only daily outcome counts, summed elapsed time and encoded bytes processed, with no image, address, hash or visitor identifier. HTTPS DNT: 1 and Sec-GPC: 1 requests do not contribute. Private browser image classification sends no statistics to the observatory. Completed UTC days are frozen once; only outcome cells with at least five operations are public, and no totals revealing suppressed remainders are published. Repeats and automated reviews may contribute; these are not counts of unique images or people. Image aggregates expire after 30 days. Missing, suppressed and unmeasured values remain distinct from zero. Optional measurement failure never relaxes screening or prevents ordinary service.
Public API responses and exports include definitions, collection status, measurement limits and installed-model information. Anyone can retain downloaded copies beyond our retention schedule. This collection does not store which visitors view or reveal a warning, click a result, or use the observatory.
Console settings and other site features
Chart calculations, saved views and display preferences run in your browser. Saved views and themes use local browser storage; you can delete saved views in the console or clear the site's browser data. A shared view link contains selected variables and filters in its fragment. Reports requested from the server include dataset filters such as world, time window and public server/word selection. The console adds no visitor-tracking or advertising analytics and does not run an AI model.
Weather location lookup and local display/art preferences are separate from search analytics. Automatic regional weather uses your connection address to estimate a region; the weather source and approximate location are shown. Mobile networks often report a central city instead of yours. If you press [ my location ], your browser asks your permission, rounds its location to a tenth of a degree (about 11 km) and sends only that rounded point; this server asks OpenStreetMap's Nominatim for the town at that point, checks the name against the weather gazetteer and keeps the town name in your browser like a city you typed. The point is not stored or logged with your address. Weather providers receive rounded coordinates rather than your address. A bundled global land-cover map is consulted locally without sending coordinates to NASA. The shape of the horizon in the large landscape -- which way the view faces, where the ranges stand, how far off they are and where the snow line falls -- is worked out on this machine from a bundled copy of NOAA's ETOPO1 global relief model (Amante & Eakins, 2009); no coordinate is sent anywhere to draw it. Heights are drawn on a compressed vertical scale, because a real range a hundred kilometres away stands less than a degree above the horizon, which is one line of type: the shape of the skyline is true while its height is turned up until it can be seen. Open water is drawn only where the land-cover map measured open water nearby, on the side it was measured on. Successful public map features are cached in rounded regional buckets for up to 90 days, without an IP, visitor ID or visit history. Calendar decorations use the selected region and its local date; the local/worldwide/off preference stays in your browser. No weather visit invokes a model. The site uses a random artwork-session cookie to keep your ASCII composition stable; it is not a search-analytics identifier. Normal network handling of addresses and security controls is separate from the observatory's aggregate records. See the field guide for details.
Explore the public observatory