What we know about you

This site asks police services what they collect and how long they keep it. It would be incoherent not to answer the same question about ourselves — to the same standard, with a citation on every line.

"No analytics" would not have been the same as "no collection." A site can run no analytics at all and still hand a reader's address to its host, its font provider and its map provider before the page finishes loading. What follows is everyone who sees something when you read this, not just the tool we chose to install.

Collection is not the problem

This site does not argue that reading a licence plate is wrong, and it would be inconsistent to argue that counting a page view is. The position is the same in both directions: collect what the job actually requires, say plainly that you are doing it, bound how long you keep it, and let someone outside check.

Is it necessary?

A toll gantry has to read your plate — billing by plate is the service you entered. A map has to load tiles. Necessity is not a free pass, but it is a real distinction, and it is the one most surveillance debates skip.

Is it proportionate to the purpose?

Reading every plate on a road to catch a stolen car is a different proposition from reading the plate at a toll booth. Counting which pages get read is a different proposition from following a named person around a site.

Is it disclosed?

Undisclosed collection is the part that corrodes trust, whoever is doing it. This page exists so that nothing here is undisclosed — including the parts that make us look worse.

Is it bounded?

Indefinite retention is where proportionate collection quietly turns into a database. It is why we ask police services for their configured retention period, and why we publish ours.

Can anyone outside verify it?

This is the one nearly everybody fails, us included. It is the whole argument of this site: when every safeguard is a setting, an assurance from the organisation holding the data is not the same as a check on it.

So this page is not a claim to collect nothing. It is the same accounting we ask of a police service, applied to ourselves, on the understanding that the answer 'we needed it for this, we keep it this long, here is the documentation' is a legitimate answer — and that refusing to give that answer is the actual problem.

The comparison that matters

We hold this site to the standard we apply to police services, so here is the honest version of that comparison. It is not flattering in every direction, which is the point.

Who	Keeps data on	For how long
Peel Regional Police, ON	Drivers who matched nothing	24 hours (matches: 30 days)
Toronto Police, ON	Drivers who matched nothing	7 days (hits: 365 days)
Readback (via Google Analytics)	Readers of this site	2 years, as a cookie on your device — which you can delete
Readback (via Google Analytics)	Readers of this site	2 months, as event and user data on Google's servers

A cookie lifetime is not the same thing as a plate database, and we are not going to pretend it is. But the number is longer than either force keeps a licence plate, and a page that hid that while running this site's argument would deserve the challenge it got.

The difference is who holds it. Our two-year figure is a cookie sitting on your device, and you can delete it right now — no request, no form, no waiting. Do that and we are back to knowing nothing about you. You cannot delete a plate read out of a police database; there is no button, and the only route in is a freedom-of-information request that takes months and may come back redacted. That asymmetry is the entire reason this site exists, and it is why we would rather publish this page than be caught omitting it. Delete, allow and manage cookies in Chrome → · Opt out of Google Analytics entirely →

Everyone who sees something

Cloudflare Pages

Required Every page

Our host. Every page, image and data file on this site is served from Cloudflare's network, so Cloudflare sees every request made to readback.ofrecord.ca.

Why it is here: The site cannot be served to you without a host, and a host necessarily sees the request. The only real choice here is which host, and whether we name them.
What it collects: IP addresses, traffic routing data, system configuration information, and other information about traffic to the site. This happens at the network level — there is no way for us to serve the site without it.
“The information processed may include but is not limited to IP addresses, traffic routing data, system configuration information, and other information about traffic to and from Customers' websites, devices, applications, and/or networks.” — Cloudflare Privacy Policy
How long it is kept: Not documented Cloudflare's Privacy Policy and Data Processing Addendum give criteria for how long they keep data but state no period. The only concrete figure Cloudflare has published — discarding access logs within four hours — comes from a blog post dated April 2013 that no current documentation restates. We are not going to present a 13-year-old blog post as today's retention policy.
What we can see: Nothing identifying. Log access (Logpush) is documented as Enterprise-plan only; we are on the free plan and receive no visitor IPs. We see no per-visitor data from Cloudflare at all.

Sources: Cloudflare Privacy Policy · Cloudflare Customer DPA · Logpush availability by plan · "What Cloudflare Logs" (2013, dated)

Cloudflare Email Address Obfuscation

On by default 45 of 46 pages — everywhere the footer contact link appears

A Cloudflare feature that hides the contact address in our footer from scrapers. It rewrites the mailto: link into an encoded one and injects a small script that decodes it in your browser. We did not go looking for this — Cloudflare documents it as “enabled automatically when you sign up” — and we found it only by diffing what we published against what the live site actually served.

Why it is here: Nothing needs this. It is a Cloudflare default rather than a decision we made, and we intend to turn it off: the anti-scraping benefit is close to zero for an address already published on GitHub and at the top of every freedom-of-information letter we file, while the cost is that our contact address stops working for anyone browsing without JavaScript. It is listed here rather than quietly fixed because this page is supposed to describe what actually runs, not what we meant to run.
What it collects: Nothing that we can observe. The script is 1,239 bytes, served from readback.ofrecord.ca rather than a third-party host, and contains no network requests, no cookie access, and no browser storage — you can fetch it and check that yourself at the URL below. Cloudflare already sees the request for it, as it sees every request to this site, which is covered in the Cloudflare Pages entry above.
“Email addresses on your web page will be hidden from bots, while keeping them visible to humans.” — Cloudflare, on Email Address Obfuscation
How long it is kept: No data collected to retain There is no separate collection here, so there is nothing with its own retention period. One honest caveat: Cloudflare's documentation for this feature does not address data collection or cookies at all, so the statement above rests on our own inspection of the script and of what the page requests, not on a Cloudflare commitment. That is weaker evidence than a published policy, and we would rather say so than present it as documented.
What we can see: Nothing.

Sources: Cloudflare — Email Address Obfuscation · The script itself, as served on this site

Google Analytics 4

Chosen Every page

Our analytics. Added 2026-09-02 so we can see which pages people actually read. It is the only thing on this list we deliberately added: everything else here is either required to serve the site or switched on by default by someone else.

Why it is here: Nothing breaks without this. We added it to see which pages are actually read and which sources send people here, because a transparency project that cannot tell whether anyone is reading it cannot prioritise what to file records requests about next. It is the one entry on this page we could remove tomorrow, which is exactly why it gets the most scrutiny.
What it collects: Sets two first-party cookies (_ga and _ga_<container-id>) to distinguish users and persist session state. Collects approximate geolocation, browser and device information, session statistics, and page details including page location, referrer, title, language and screen resolution.
“Used to distinguish users.” — Google, on the _ga cookie
How long it is kept: Cookies: 2 years on your device. Event and user data: 2 months, our setting Both cookies expire after two years. Separately, Google's event- and user-level data retention is configurable to either 2 months or 14 months on a standard property, and we have set ours to 2 months — the shortest Google offers. Google publishes those two options but does not document what a newly created property defaults to; that claim is repeated widely elsewhere and we could not trace it to Google's own documentation, so we do not repeat it. One limit worth stating: the retention setting governs only Explorations and funnel reports. Standard aggregated reports are not affected by it, so the aggregate picture — how many people read a page — persists beyond two months.
Take our word for it, and note that you have to. This is the one figure on this page you cannot check. Every other retention period here is published by the company that sets it; this one is a dropdown in our Google Analytics admin that only we can see. That is exactly the problem this site was built to point at — a safeguard that is a setting, attested to by the organisation that configured it, with no way for an outsider to verify. We are not exempt from our own argument, so: we have set event and user data retention to 2 months, and you are taking our word for it.
What we can see: Aggregate reports: page views, rough location, browser and device mix, and how people arrive. We do not see individual identities. Google's documented position is that raw IP addresses are discarded after use and never associated with user identifiers — though the wording is firmer for EU, Swiss and UK visitors, where IPs are explicitly never logged, than it is elsewhere.
What you can do about it: These two cookies sit on your device, not ours, which means they are the one thing on this page you can delete yourself — right now, without asking us. Clearing them resets us to knowing nothing about you. You can also block them before they are ever set, or opt out of Google Analytics across every site that uses it. Delete, allow and manage cookies in Chrome → · How Google uses cookies → · Google Analytics opt-out browser add-on →

Sources: GA4 cookie usage · GA4 data retention · Data collected by Google Analytics · IP addresses, EU/Switzerland/UK · IP addresses, other regions

OpenFreeMap

Required The map page only

Our map tiles. When you pan or zoom the map, your browser requests tiles directly from OpenFreeMap — which means the areas you look at are visible to them, not only to us. On a map of surveillance cameras that is the most sensitive thing on this page, and it is why we picked a provider that publishes a policy at all.

Why it is here: A map needs map tiles. We are keeping this provider rather than self-hosting: running a tile server is a real cost and a real failure point for a project this size, and the honest trade is to disclose the provider plainly rather than pretend the request does not happen. If the map ever gets heavy enough use to justify self-hosting, that changes.
What it collects: Anonymised logs including browser type, referring and exit pages, date and time stamps, and operating system. The operator states these logs do not contain IP addresses, and that no cookies or tracking technologies are used.
“By default, we do not log IP addresses. However, if we detect a security incident (such as an attack on our service) or misuse, we may temporarily enable IP logging for a maximum of 30 days to investigate and resolve the issue.” — OpenFreeMap Privacy Policy
How long it is kept: Anonymised logs: indefinite. IP logs during a security incident: 30 days maximum We want to be precise here because it would be easy to overstate: OpenFreeMap does not claim it never logs IP addresses. It claims it does not log them by default, and may log them for up to 30 days while investigating an attack or misuse, after which they are permanently deleted. What their policy does not address is whether individual tile requests — the actual record of which map areas were viewed — appear in the anonymised logs it keeps indefinitely. We asked that question of the documentation and it is not answered there.
What we can see: Nothing. We receive no data from OpenFreeMap about who loaded which tiles.

Sources: OpenFreeMap Privacy Policy · OpenFreeMap

Wikimedia Commons

Required for what it does Two camera popups on the map

Community photographs of two specific cameras. Two of the 1,364 mapped cameras have a reader-contributed photo hosted on Wikimedia Commons. Opening either of those two map popups makes your browser fetch the image from Wikimedia directly.

Why it is here: These two photographs are evidence — a reader can see the actual camera rather than taking a dot on a map on faith, which is the whole direction this project is moving in. Hosting the images ourselves would remove Wikimedia from this page, but it would also detach them from the record that establishes their licence and provenance. We are keeping them where they are and disclosing it.
What it collects: Device type, browser type and version, browser language, operating system, in some cases your internet service provider, the referring website, which pages you request, and the date and time of each request. Wikimedia's privacy policy explicitly covers this case — third-party pages that load Wikimedia content.
“This includes when you use an online tool on a third-party site that loads information coming from the Wikimedia Sites.” — Wikimedia Foundation Privacy Policy
How long it is kept: 90 days, extendable to 180 days Wikimedia's data retention guidelines specify that visitor IP addresses are deleted, aggregated or de-identified after at most 90 days. The table that would contain a hotlinked image request carries a documented exception allowing an extra 90 days when investigating automated traffic spikes, to a maximum of 180, so 90 days is the floor rather than the ceiling.
What we can see: Nothing.

Sources: Wikimedia Foundation Privacy Policy · Wikimedia data retention guidelines

What is not here

Absence is a claim too, so these are stated as specifically as the presences above.

Web fonts. The site loads no fonts from Google or anywhere else. Type is rendered with fonts already on your device, so nothing about your visit reaches a font host.
Embeds. No YouTube players, no social embeds, no comment widgets. Embeds set cookies before anyone clicks them, so we link out instead.
Advertising and third-party trackers. No ad networks, no retargeting pixels, no social tracking pixels, no session recording, no heatmaps, no A/B testing tools.
Accounts. There is nothing to sign up for. We hold no reader accounts, no email list, and no newsletter service.
Server logs of our own. The site is static files on a content delivery network — there is no origin web server of ours running Nginx or Caddy, and so no access log we could keep or truncate. That does not make the collection disappear; it moves it to Cloudflare, which is why Cloudflare is the first entry above rather than an omission.

Where the documentation runs out

We file freedom-of-information requests because organisations do not always publish what they do. The same problem applies to the companies we depend on, and pretending otherwise would be the overclaim that gets a site like this caught. Three gaps, stated plainly:

Cloudflare does not publish a retention period. Its privacy policy gives criteria, not durations. The only concrete figure it has published is in a blog post from 2013 that no current documentation restates, so we do not cite it as current practice.
Google does not document a default retention period for a newly created Analytics property. Two options exist, 2 months and 14 months. The claim that new properties default to the shorter one is repeated widely but we could not trace it to Google's own documentation, so it is not on this page as fact.
OpenFreeMap does not address tile-request logging. Its policy covers IP addresses clearly and commits to keeping anonymised logs indefinitely, but does not say whether the record of which map areas were viewed is among them.
Cloudflare does not document whether its email-obfuscation script collects anything. Its documentation describes what the feature does and never addresses data or cookies, so what we say about that script above comes from reading it ourselves rather than from a commitment anyone is bound to.

We found the fourth of these by comparing the files we published against what the live site actually served, and we would not have found it any other way. That is worth stating on a page like this: the gap between what an organisation believes it runs and what it actually runs is not usually malice, which is exactly why nobody should be asked to take it on trust.

Corrections wanted. If any operator above documents something that contradicts this page, send the link and we will correct it and say that we did. [email protected] Every claim on this page was checked against its source on 2026-09-02.