What we record when you visit
Everything rotation.to keeps about the people and programs that visit it, signed in or not, in plain words.
Updated
In short
- We count page views, to see which pages are read, and whether by people or by programs. We do not try to find out who you are.
- Your internet address is cut short before it goes into our records, so it usually points to a block of addresses shared by many people rather than to your own connection; with some newer (IPv6) connections that block can still be a single home or office. The web server’s own log holds the full address for about two days first. Your country is the only place we record.
- We set no cookie and no ID to follow you from page to page or from one visit to the next. What links your page views is only what every web server sees: your network, cut short, and your browser’s name, which the owner’s traffic page uses to count visitors each day. The site sets no cookie unless you sign in.
- If your browser sends Do Not Track or Global Privacy Control, our page script does nothing at all; the web server still notes each request, as every web server does.
- Records of visits are deleted after 90 days, and gone from the daily backups about two days after that. Only the site’s owner sees them, and the AI assistants he uses to build and run the site.
- No page you can open loads anything from another company: no advertising, no outside analytics, no outside fonts or images.
Every visit
Like every web server, ours notes each request it answers. From each one we keep:
- when it came, and the page it asked for, without anything after a question mark in its address. A link can carry four labels saying where it was shared (utm_source, utm_medium, utm_campaign and ref), and we keep those; of anything else on the end of an address we keep only that it was there;
- which of the site’s addresses it was sent to, and whether it asked for something or sent something;
- whether it was answered, how big the answer was and how long it took;
- what kind of request it was: a page, a link your browser fetched ahead of a click, an image, and so on;
- the name your browser sends about itself, such as Chrome on a Mac with its version number, up to its first 200 characters;
- the first language your browser asks for;
- the name of the website whose link brought you, if your browser says, and never the rest of that page’s address;
- your country, as the network service that carries the site’s traffic reports it;
- your network, cut short: the first three of the four numbers in an older (IPv4) address, or the first three of the eight groups in a newer (IPv6) one;
- the reference number the network service gives that one request.
Our web server’s own log file holds the details of each request for a short while, your full internet address and the whole address of the page included, before anything is cut short. It keeps only its five most recent parts and deletes the older ones; at October 2026’s traffic that is about two days. The network service that carries the site’s traffic sees each request on its way, as any such service does. The network service also asks browsers that support it to report to it, for a week, any page of this site that fails to load: the address, the kind of failure and how long it took.
Our page script
Each page includes a small script of our own, served by this site. If your browser runs it and has not asked not to be tracked, it reports, while you are on the page:
- how long the page was in view, in milliseconds, up to 30 minutes;
- which item in the site’s top bar you clicked, if you click one (a menu item, or the theme switch, which is also on the sign-in page): the words on it, the part of the menu it sits in, where it leads, and the page you were on;
- whether your browser says a program is driving it, which automation software sets;
- whether the page has been touched: yes or no, set by the first click, tap, key press or turn of the mouse wheel your browser reports. Never where, which key or how often. The only time kept is when the report carrying the yes arrived, as for every report.
Each page makes up a random number for itself, so that its repeated reports can be put together. We scramble it with a key that changes every day before keeping it, and the page forgets it when you leave, so the number cannot link one page to another. With each report the server keeps the same kind of details as for any request: the kind of browser (such as Chrome on a Mac), your country, your network cut short, your first language and the request’s reference number.
It never records where the pointer goes, how far you scroll, what you type, what you put in a form, or the words on the page beyond the menu’s own labels. If your browser sends Do Not Track or Global Privacy Control, the script stops before it starts and sends nothing; the server’s note of each request, above, is kept either way.
If you sign in
- Your account: your email address, your name if you give one, how you sign in, your password only as a scrambled check value that cannot be turned back into it, your membership level, whether the account is waiting, active or suspended, who approved it, when the account was made and approved, and when you last signed in.
- Each sign-in: when, which account, how you signed in, your country and your network cut short, as above. A sign-in refused because an account is not active is noted the same way.
- Requesting access: the owner receives your request to decide on. We keep your email address, your chosen password only as a scrambled check value, your country, your network cut short, the name your browser sends (up to its first 500 characters), when you first and last requested, how many times, and the owner’s decision, when he made it and any note he adds. Repeat requests do not change an existing password. The request is kept with no fixed end. Without an account there is no way yet to ask for it to be removed.
- Trying to sign in through another service with no active account here: the sign-in is refused and noted like a sign-in. It does not create an account or an access request.
- What you choose to keep here: your portfolios, trades and what-if trades with your notes, your watchlists, the people and companies you follow, and your settings. In Settings, Your data you can download a copy, or ask for your account and what you keep here to be deleted; the owner decides and will contact you, and nothing is deleted when you press it.
Your page views are not tied to your account: the records of visits hold no account, name or email, and the site does not match them to your sign-ins, although both keep your network cut short. The one exception is the site’s owner: his own pages are marked as his, and visits from networks he has signed in from are counted as his (anyone else on such a network is counted with him), so that he can leave himself out of the counts.
How long, and who sees it
- Records of visits and the page script’s reports: 90 days, then deleted automatically, in a check that runs every hour, and gone from the daily backups about two days after that.
- Your account, what you keep here and your sign-in records: kept with no fixed end. You can ask for them to be deleted in Settings, Your data.
To count visitors, the owner’s traffic page groups the page views that share a network, a browser name and a day. The grouping is worked out when that page is opened, and it is never stored.
Only the site’s owner can see the records of visits and every account’s sign-ins: the pages that show them open for his account alone. The AI assistants he uses to build and run the site can also read them on the site’s own server when he asks, and what they read is processed by the AI services they run on. You can see your own recent sign-ins in Settings, Security, and what you keep here in Settings, Your data. None of it is sold, and no advertising or analytics company receives any of it. Where the site’s own data comes from is on Data sources.