What this site collects, and what it does not.
AuditTrace Labs is built around evidence that can be examined and boundaries that are explicit, and this website is held to the same standard. This page describes the actual implementation — what is collected, what is not, and how each class of information is handled — so it can be checked against what the site actually does.
Last updated: 2026-09-03 · Applies to this website. Information handling inside a specific engagement is governed by the scope agreed for that engagement.
The short version
- This site sets no cookies and uses no browser storage.
- There are no third-party scripts, fonts, embeds, pixels or trackers. Every asset is served from this domain.
- We keep limited first-party measurement — a small record each time a page is viewed or a link is used, collected by our own server, for our own use, and counted up from there.
- The measurement system does not store your IP address. It stores a value derived from it that changes every day, so it keeps no identifier that persists from one day to the next.
- If you send an inquiry, we receive what you typed and reply to it. A person reads it. Nothing is sold, rented or added to a mailing list.
1. Information you choose to send us
The inquiry form asks for your name, an email address, and a short description of the matter, plus the general type of matter. You may optionally give an organization name, a phone number, and a preferred contact method. The type of matter and the preferred contact method are chosen from fixed lists, which the server re-checks; the remaining fields, including the description, are text you write yourself.
When the form is submitted, our server also records the referring page if your browser supplied one, and the date and time of receipt. The inquiry is delivered to us by email at contact@audittracelabs.com. It is not written into a website database.
There is no automated confirmation email. After you submit, the page itself shows the confirmation and nothing is sent to you automatically. We reply using the contact details you provided.
Please do not send sensitive material in a first message
Do not send passwords, authentication credentials, private keys, access tokens, full evidence collections, or confidential third-party information through the inquiry form or by ordinary email. The website accepts no file uploads. If a matter proceeds, we will agree an appropriate method for exchanging the relevant material.
Sending an inquiry does not create a client relationship, and it does not mean a matter has been accepted. See Terms of use and Promises and limits.
2. Limited first-party website measurement
We want to know whether the site explains the company, and which pages people actually reach. We do that with a small collector that runs on this domain (/a.php) rather than a third-party analytics service. Nothing about your visit is sent to another company.
The only events recorded
The collector accepts six event types and rejects anything else:
- page — a page was viewed
- cta — a labeled link or button was activated (navigation, a call to action, an outbound link, a download, an email link)
- form_start — someone began filling the inquiry form
- form_success — an inquiry was submitted successfully
- form_failure — a submission failed, and the reason code
- err404 — a page was not found
What is stored with an event
The time of the event, the path you were on, the referring address if your browser supplied one, which released version of the site the event came from, the section of the site it came from, the label of the link activated, whether the page was working without JavaScript, and campaign parameters if the link you followed carried them. The contents of form fields are never collected — the measurement records only that a form was started, succeeded or failed.
How the collector treats your address
Your IP address is not stored. Instead the collector derives a short hash from your address combined with the current date and a fixed string set in the collector's code. Because the date is part of the input, the value changes each day, so the collector keeps no identifier that persists across days. It exists so we can tell roughly how many distinct visits a page had within a day, and to review abuse.
Two things about that value are worth stating plainly rather than leaving you to assume. Within a single day, events from the same address share one value, so one day's path through the site can be linked together. And because the fixed string lives in the code rather than in a protected secret, the value is best understood as a pseudonym, not anonymized data — we describe it that way rather than calling it anonymous.
Events are appended to dated files stored outside the public web directory. Raw event files are deleted once they are more than 90 days old, and that deletion is performed by the collector itself rather than being only a stated intention. One honest qualification: the deletion is triggered by later traffic, so if the site received no further events a file could persist past 90 days until traffic resumes.
Cloudflare Web Analytics is not in use at this release
An additional privacy-conscious analytics service has been considered but is not enabled on this release of the website. If it is enabled later, this page will be updated to name it, describe what it collects, and state its retention separately — we will not imply that a third-party service follows the same 90-day schedule as our own collector.
3. Cookies and browser storage
This site sets no cookies. It does not use local storage, session storage or IndexedDB, and it does not attempt to identify your browser or device by its configuration. There is no cookie banner because the site sets no cookies and uses no browser storage.
If that ever changes, the change will be described here before or at the time it takes effect.
4. Technical and security records
Two things are separate from the measurement described above.
Hosting logs. The site runs on standard managed hosting, and that hosting environment may keep its own server request logs, which can include IP addresses and the time and path of each request. These logs are generated and retained by the hosting provider as part of running the server, not by AuditTrace Labs, and their contents and retention are governed by the hosting environment rather than by this website.
Abuse prevention. To stop the inquiry form being used for spam, the server keeps a very short-lived record derived from the requesting address — a hash, not the address itself — together with submission timestamps. These records expire after ten minutes and are cleared by the handler as later submissions arrive, so a final record can sit unused until the next one comes in.
5. What this site does not do
Based on the implementation shipped in this release, this site does not use:
- session replay or screen recording
- keystroke, mouse-movement or scroll-path capture
- browser or device fingerprinting
- cross-site or cross-device behavioral tracking
- advertising pixels, ad networks or remarketing
- collection of anything you type into a form field as measurement data
- scoring, ranking, or profiling of individual people
- third-party embeds, hosted fonts or content delivery networks
We also do not sell, rent or trade inquiry information, and we do not add you to a mailing list because you contacted us.
6. Why we have it
The inquiry information exists so a person can read your message, understand whether the matter is something AuditTrace Labs can appropriately help with, and reply to you.
The measurement exists so we can tell whether the website communicates what the company does — whether visitors reach the pages on system-state preservation, data forensics, research and the program, and whether the inquiry path is usable. We use it to evaluate the website, not to evaluate you.
7. Who sees it
Inquiries are read by AuditTrace Labs. Our hosting and email service providers process information as necessary to provide those services — delivering the website and carrying the email that contains your inquiry.
We do not otherwise disclose inquiry information, other than where we are required to do so by law or where you have asked us to.
8. How long each class of information is kept
Different classes have genuinely different retention, so we list them separately rather than quoting a single number for everything.
| Class | Retention | How it is enforced |
|---|---|---|
| Inquiries that do not become an engagement | Up to 12 months, then deleted when no longer needed | Mailbox practice, reviewed periodically |
| Inquiries that become an active engagement | Move into the record for that matter and follow its retention requirements | Agreed per engagement |
| Raw first-party measurement events | Deleted once more than 90 days old | By the collector in code, triggered by later traffic |
| Aggregate or non-identifying measurement | Retained to compare trends and releases over time | Derived from the above before deletion |
| Abuse-prevention records | Minutes | Deleted automatically by the handler |
| Hosting and server logs | Determined by the hosting environment | Controlled by the hosting provider, not by this site |
If you would like your inquiry deleted sooner, email us and we will delete it from our mailbox. Copies held by our email provider as part of its normal operation, such as routine backups, then age out under that provider's own retention.
9. Your choices
You can browse the site without submitting anything; the inquiry form is optional and you are welcome to email us directly instead.
If you have sent us an inquiry, you can email contact@audittracelabs.com to ask what we hold about that inquiry, ask us to correct it, or ask us to delete it. We will tell you what we have done. Please send that request from the address you used to contact us, or give us enough detail to find the right message.
Depending on where you live, you may have additional rights over your personal information under local law. This page does not attempt to summarize those rights or to determine which of them apply to you; if you want to exercise a right you believe you have, tell us what you are asking for and we will respond.
10. Children
This site is not directed at children and we do not knowingly collect information from them.
11. Changes
If this page changes, the date at the top changes with it. Where a change alters what is collected rather than only how it is described, we will say so explicitly rather than relying on the date alone.
12. Contact
Questions about this page, or about information you have sent us, go to contact@audittracelabs.com. AuditTrace Labs LLC is the entity responsible for this website.