This is a measurement rig for an origin-side agent classifier, not a product with users. It is documented here in full because two third parties are involved and because it collects more than the classifier it is calibrating ever will.
Cloudflare Turnstile runs on every page load, in invisible mode, and no visitor is ever shown a challenge. It sets its own cookies and processes device and network characteristics to decide whether a browser is genuine. Cloudflare acts as our processor under the Cloudflare Privacy Addendum. We submit only the resulting token for verification; we do not forward your IP address to Cloudflare, though the widget itself necessarily sees it, as any script loaded from a third party does.
ip-api.com receives the caller IP address in order to return an autonomous-system name and a hosting flag. This is the more far-reaching of the two, and it is the reason this page exists rather than a shorter one naming only Cloudflare. Private and loopback addresses are never sent. The lookup can be turned off entirely, and then the network signal simply never fires.
Every request: the full header set, the raw IP address, the classification and the evidence behind it, a browser attestation where one was submitted, and the outcome of the Turnstile check. Nothing is truncated and the IP is neither discarded nor hashed.
That is the opposite of what the classifier does in production, deliberately. Finding out what agents actually send is the only reason this rig exists, so it keeps everything; the library it feeds derives an autonomous system and a hosting flag in-request and then discards the address. Hashing an IPv4 address is not anonymisation, so it is not offered as one.
Two things it does not collect even though nothing would stop it: canvas, WebGL and font fingerprints, and any stable identifier beyond a random id kept in your own browser storage. A signal that could never ship to production would teach us nothing about the classifier being calibrated.
Agents, and the people pointing them here. It is not intended for the public and is not advertised anywhere. If you arrived by accident, there is nothing here for you and nothing was charged or blocked — but your request was logged like any other, which is what this page is telling you.