Privacy and research notice

CommonRig is run by Benys Labs (ABN 74 950 841 543), Victoria, Australia. Privacy questions go to hello@commonrig.com.

CommonRig records events to study discovery and purchases. Only aggregates are published. Data is never sold.

Exactly what is logged

Timestamp is milliseconds since epoch; day is UTC. Environment separates staging from production. Paths group known routes and fold identifiers. Referrers retain only their host and source class. Campaign labels are validated. Actor, confidence, family and signals describe request classification. Country is the two-letter Cloudflare country. Channel, tool, product and rail describe the interaction. Only paid and refund rows include an amount and currency. Provider order references are keyed HMAC hashes.

Weekly visitor hashes

An IP address and coarse user-agent family are hashed in memory using HMAC-SHA256 and a random 32-byte salt. The result is shortened to 16 hex characters. Salt rotates each Monday at 00:00 UTC on first use; the previous salt is deleted. A separate secret hashes order references.

No raw IP, raw user agent, email, buyer wallet address or query string is stored. Doctor bundles, licence keys and payment signatures are not logged. Our test header or configured own IPs add an own-traffic flag. No cookies are used. A same-origin script sends one engaged event on first pointer, scroll or key interaction, with the grouped page path and navigator.webdriver flag. There is no other browser fingerprinting.

Retention

Events are append-only and retained for 400 days. A daily job deletes older events. Salt is private to the store and not read by the research collector. Orders store payment references and licence hashes for fulfilment; licence plaintext is shown once and never stored.

Third parties

Cloudflare hosts this store. Payment processors keep their own payment records; public blockchain transactions are public. Contact hello@commonrig.com for privacy questions.