# Privacy and analytics

This book uses anonymous traffic analytics to understand which pages are useful,
how long pages remain open, and how much time readers actively spend using them.
The analytics do not inspect or transmit quiz answers, activity responses, saved
progress, or code written in live-code cells.

For each visit, the book creates a random identifier in the browser's temporary
session storage. It expires with the browser session and is replaced after 30
minutes without activity. It is not used to recognise a reader across visits.
The book records page paths, page titles, active and elapsed time, the referring
website's hostname, and a broad device category.

Analytics requests pass through Cloudflare. Cloudflare uses the request's IP
address transiently to determine a two-letter country code and to limit abusive
traffic. The IP address is not stored in the book's analytics database and is not
forwarded to Supabase. Raw browser user-agent strings and complete referring URLs
are also not stored.

Supabase stores event-level records for 90 days. Daily aggregate counts, including
cumulative visits, page views, active time, countries, referrers, and device
categories, are retained indefinitely so that the maintainers can understand the
book's long-term use. Access to the reports is restricted to authorised book
maintainers.

Questions about this processing can be sent to the maintainer listed on the
{doc}`credits` page. The production analytics configuration is subject to TU Delft
privacy and legal approval.