Site activity & privacy
How HuggingThreat measures use of the site.
What is recorded
The site records page paths, times, IP addresses supplied by the hosting edge, referring website names, country, broad browser and device categories, sign-ins, and successful activity such as submissions and run requests. The administrator can view this activity in a restricted dashboard. An IP address can be shared or change and does not establish a person's identity.
Accounts and browser identifiers
If you sign in with Hugging Face, activity while signed in is associated with a site-specific, cryptographically pseudonymized account identifier. The activity system does not store your name, Hugging Face username, email, or original account ID. Other visits use a random first-party browser cookie. Earlier anonymous events are not relabeled as signed-in events when you sign in. Account information used for authentication and attribution of existing submissions is separate from this activity system.
The ht_visitor cookie lasts up to 90 days, renewed with recorded page views. The ht_visit cookie groups activity into visits and expires after 30 minutes without a recorded page view. Clearing cookies creates a new browser identifier. Authentication uses a separate session cookie.
Limits and controls
The activity system does not store full user-agent strings, URL query parameters, form contents, access tokens, or screen recordings. Hosting providers may maintain separate operational and security logs. Do Not Track and Global Privacy Control signals disable this activity collection.
Activity is retained for a rolling 90-day window; expired records are removed when new activity is recorded or the administrator opens the dashboard. Existing assessment results, comments, and submissions have their own storage lifecycle.
For questions or a deletion request, contact the maintainer.