BOT Intelligence Network — collection policy

Supported page and API GET requests are recorded without an application-level daily count cap.
Stored: UTC time, country code, ASN, coarse User-Agent family, matching known BOT token (if any), HTTP protocol, and the fixed route name.
Not stored in the application database: IP addresses, raw User-Agent strings, cookies, authorization headers, request bodies, referrers, or query strings.
Detailed observations and aggregate history have no automatic deletion period or application-level storage cap. Cloudflare's hosting and free-plan quotas still apply.
Published: aggregate distributions and attribute combinations with at least 3 observations; no upper limit on the number of aggregate groups. BOT profile pages publish counts and first/last seen of unverified claimed tokens. No per-request list or individual tracking identifiers are published.
Explicit BIN verification User-Agents, health checks, non-GET requests, unknown routes and rejected short bursts are excluded. Initial test observations, including the owner's browser test, have been removed.
Short burst protection uses the connecting IP transiently in Cloudflare's rate limiter; the IP is not stored in this application's database. Its approximate limit is 60 requests per 10 seconds per IP at each Cloudflare location. This is a basic burst control, not a guarantee against distributed attacks.
Client families and BOT tokens are self-asserted and may be spoofed. No human/bot classification or unique-visitor estimate is performed. Earlier family-only records cannot be assigned to individual bots.
Only traffic to this service is observed; no claim of Internet-wide coverage is made.
Cloudflare also processes requests as the hosting provider; its operational logs are separate from this application's dataset.