Your browser stores att_id (a random id it makes itself), att_n (how many visits) and a marker for the current visit. They live in local storage on your machine, they are not a cookie, they carry no name and no address, and clearing site data deletes them. We use them to count how many readers come back, not who they are.
Which page you opened, which window you chose, whether you drew or shared, and on the plan pages whether you pressed a plan's Choose button or made an invoice (the plan and the term, never the amount) — plus that random id and the referring site. If the link that brought you carried campaign tags (utm_source, utm_medium, utm_campaign), those tags are kept with the row; of an ad-click id we keep only that there was one. It goes to our own log. Your IP address is hashed together with the day before anything is written, so the same reader on two days is two different rows to us.
Every page carries a short token so the data windows open from the page and not from a scraper. It is made from the host, the hour and your IP, it identifies nobody, and it dies within two hours.
Metric pages (/m/…), the lab and the cards carry no third-party script at all: no ad network, no analytics vendor, no session recorder; the scripts there are ours, from this domain. The home catalog and /today/ show chart previews and carry the Google tag described under Measurement, as do the plan, account and text pages. The site's own network sees requests as a CDN does; that is the whole list.
Pages may load a conversion tag for our advertising account (Google Ads) on /pricing/ and /account/; its events carry no name, email or payment details. The Google tag (gtag.js) of that account counts conversions from our ads; it runs on the home page, /today/, the plan and account pages and the text pages (sign-in, terms, refund, privacy, notes, changelog), never on metric pages, the lab or the cards. Like any request to Google, it gives Google your IP address, your browser and, where cookies are allowed, Google's cookie id. In the European Economic Area, the UK and Switzerland it starts with ad storage, ad user data, ad personalization and analytics storage denied; elsewhere Google's defaults apply.
One address: to sign you in, to tie your plan to you, and for letters about your plan: the invoice you create, what we see of your payment, the receipt, API key notices, a reminder seven days (7 × 24 hours) and one day before your paid term ends, and one note when it ends. Never sold, never handed on, never used for anything you did not ask for. These letters go out through a mail provider, which sees the address and the letter. If the mail provider does not take a message, the site keeps that message — recipient address, subject and text — in its own queue and retries for up to eight days, then drops it.
Set when you confirm sign-in by pressing the button on the page the sign-in link opens; opening the link alone sets nothing. It holds an account id, the plan and an expiry, signed by us; it cannot be edited without breaking the signature. HttpOnly, Secure, SameSite=Lax, 30 days — or shorter, if your plan ends sooner. Your account page renews it when your plan changes or is extended. Signing out clears it. It is never sent to anyone else. att_s is the only cookie we set ourselves; on the pages with the Google tag, Google's tag may set its own cookies (_gcl_*) on this domain outside the European Economic Area, the UK and Switzerland, and inside them its consent starts as denied.
Your email, the plan, the day it started and the day it runs out, and — if you asked for an API key — a one-way hash of that key plus its first characters, so you can recognise it (the hash lives in its own record next to the account row, not inside it). No password exists to store. No name, no address, no company, no card: card details never reach us (see Payments below).
If you link the bot to your account, we keep two small records: one under your account with the numeric id of that chat and when you linked it, and one under the chat that points back to the account. A successful unlink in your account removes both records. The bot also asks the site to unlink when you send /unlink or /stop. If the site is unavailable or account linking is switched off, the site records can remain: finish unlinking in your account when the service is available. Linking a different chat replaces the old link. While linked, the bot keeps the account id, your plan name, a two-letter hint of your email, when the chat was linked and when it last checked the plan. It also keeps an account id on saved rules to count the plan limit across chats. Unlinking clears the current local link but keeps that rule ownership. Saved rules above the account or chat limit pause and still occupy account slots; they can resume when the limit or link allows it.
An invoice id, the plan, the amount in dollars and in sats or USDT, the address it is paid to, and the proof the payment settled (a payment id or a transaction id). Kept because money needs a record: about 400 days after payment, and an unpaid invoice about 60 days. For a USDT invoice we also keep a keyed hash of your network address for 24 hours, to cap how many USDT invoices one network can open. The payment rail — a payment server or the chain itself — sees the payment; we never see a card, a bank or an identity document.
Card payments are processed by a merchant of record (the payment partner shown at checkout); we do not store card data. Crypto payments go to our own wallet addresses. On the Desk plan we also record the first file download or the first call with the API key — the date and time in UTC and which file or call it was — and show it in your account; the record serves only the refund policy and is kept with your account data.
The numeric id of the Telegram chat that talks to @askthetape_bot — not your name, not your username, not your phone number — plus the rules you confirm there (the line, the level, the side and when you confirmed it), their active or paused state, your chosen priority and a record of each alert it sends. Account-owned rules also retain an account id after unlinking. Limits are Free 2, Tape 10 and Desk 50 across the account, shared by price and chart-line rules; a chat without a current link has the Free limit. /list shows saved rules, /keep chooses priority and /off releases a saved slot. From the currently linked chat, /bring moves that account's saved rules and their delivery to this chat. Telegram hands any bot more than that when you write to it; this bot does not store it. Detailed records of events and deliveries are kept for up to 7 days.
An “Alert on this line” link only opens Telegram with the line, the level and the side written into the link. Nothing comes back to the site: a page cannot tell whether you confirmed a rule, and it never says so. Linking the chat to your account (above) tells the site the chat's id — not your rules or messages.
Send /stop and the bot stops writing to that chat, then deletes this chat's record, rules, drafts, confirmation receipts, pending deliveries and event records from its working storage, and tells you once what it removed. Rules and records stored for other chats remain, including rules you moved there with /bring.
Messages already sent stay in your Telegram history, and in Telegram's, until you delete them there; we cannot recall them. If a chat was blocked for abuse, the block list keeps that chat id so the block holds. The bot's service log names a chat by a salted pseudonym, not by its id, and /stop does not rewrite old log lines. So we do not promise that nothing about the chat is left anywhere — only that the working storage no longer holds it.
The bot's /privacy command points to this page. Write to hello@askthetape.com about anything the bot holds.
The account row lives while the account does. Our renewal service also keeps the recipient address, subject, message and delivery status in a database on our own machine so an uncertain send can be retried with the same message. That database currently has no automatic expiry, including after a term ends. Sign-in links die in 15 minutes and are one-time. Invoices are kept for about 400 days after payment (an unpaid one about 60 days), the daily call counters for three days, the reading log in a rolling window measured in months.
Write to us and the row goes, together with the key index, the invoices we are not obliged to keep, the renewal email records and any linked Telegram records. Messages still waiting in that mail queue are dropped too. Payment records we must retain are handled separately; deleting an account does not erase transactions from a public blockchain. You can also simply stop: an unpaid plan falls back to Free on its own.
The site and the accounts live on Cloudflare's edge; the data behind the charts is built on our own machines. When email delivery is enabled, the letters go through our mail provider, which receives the recipient address and the message.
This page is versioned with the site: when what the code stores changes, this text changes in the same build, and the change shows up in the changelog.