Privacy and retention

Heretic observes a connection, receives a browser payload, derives an assessment, and stores different data in separate layers. A deletion or retention bound in one layer does not apply to every other layer.

​

Data observed at the edge

Depending on protocol and available evidence, a full session can contain:

• the connecting IP and port
• TCP and IP handshake fields
• TLS ClientHello fields and parsed fingerprints
• HTTP/2 settings, frame order, and window information
• UDP, QUIC Initial, and HTTP/3 observations
• HTTP request metadata and selected headers
• round-trip timing

The edge can derive ASN, country, network description, and network classification from the connecting IP. Network classification remains separate from the verdict.

​

Data submitted by the collector

GET /n can carry an optional free-text tag in its query string. The final POST is a flat object containing the public site key and collected fields. The edge presents selected work-output keys as measured and the remaining fields as declared in the full session API; NDJSON retains the original payload. Measured sections can include:

• compute timing and cache probes
• GPU work and graphics observations
• worker parallelism
• frame cadence
• microarchitecture-related checks
• canvas and audio measurements

Declared sections can include:

• user agent, platform, languages, logical cores, memory claim, touch points, and webdriver state
• user-agent client hints
• display dimensions and pixel ratio
• timezone, UTC offset, and locale
• WebGL values
• the broader optional surface, including WebGPU, fonts, WebRTC metadata, media-device counts and hashed IDs, permission states, storage capabilities, battery state, codecs, runtime, and cross-realm observations

The browser sends this data to the edge. It can be modified before arrival. The rules treat declarations as claims.

​

Browser-local behavior

Collector requests use credentials: 'omit' and do not send ambient cookies or browser credentials. Endpoint resolution can cache a selected edge in sessionStorage. The default discovery cache lifetime is 15 minutes. Storage availability tests briefly write and remove probe values. rawSurface defaults to false. It changes only:

• exact WebRTC host candidate addresses
• exact battery level and finite charge or discharge times
• exact storage quota and usage

Counts, address families, coarse battery values, and storage buckets can remain. Other surface fields are not removed by this option.

​

Identity

Identity version 2 can derive machine and instance IDs from normalized components. When the edge accepts a nonempty posted public site key of at most 128 bytes, its trimmed value participates in the ID scope. Sessions without an accepted key use the unscoped fallback. The identity object can also expose normalized component material. These IDs describe matching component sets within one identity version and key scope. They do not identify a person or guarantee global uniqueness, anonymity, irreversibility, collision freedom, or continuity through every software and hardware change. Identity does not change the verdict.

​

Storage layers

​

Normal settlement

A normal session’s evidence freezes at the first valid /c. The tenant projection commits before the collector receives its request ID. Local NDJSON becomes eligible after the separate 60-second settlement threshold, and a sweep runs every 30 seconds. A session normally expires from memory 900 seconds after creation. If its local record has not persisted, the edge retains it while retrying for up to 40 sweeps, about 20 minutes of retries at the current interval. Successful persistence permits removal after the normal expiry threshold. Memory pressure can remove a session sooner. At settlement, the edge attempts two independent writes:

1. Append the full record to local NDJSON.
2. Persist the same frozen session and assessment to local NDJSON.

The edge sends the projection directly during ordinary completion. It permits 64 in-flight projections, fails immediately when saturated, applies a six-second whole-request deadline and two-second connect timeout, rejects redirects and non-200 responses, caps the acknowledgement body at 4 KiB, and parses the acknowledgement strictly. It has no internal retry queue. One store can contain a session when the other does not.

​

Edge NDJSON retention

The edge writes one NDJSON file per UTC day. Default bounds are:

• 180 days through the age setting
• 64 GiB through the byte setting

Operators can override or disable either bound. Cleanup runs after persistence activity and removes whole daily files. It can delete older files before the age cutoff to satisfy the byte cap. It always keeps the newest daily file. These are configured bounds, not exact deletion times.

​

Control-plane projection retention

A projection stores assessment fields, projected findings and family reports, provenance, projected network metadata, identity, edge, and timestamps. It has no raw-IP column. Rows become eligible for pruning when created_at is more than seven days old. Seven days is not a deletion deadline. The Worker has no scheduled pruning job. It samples a retention sweep after roughly one in every 200 successful ingest writes. Sparse traffic, interruption, or sweep failure can leave rows beyond seven days.

​

Tenant deletion

The dashboard can delete a site’s attributed projection rows. It does not rewrite edge files, remove live state, revoke keys, archive the site, or delete unattributed rows. The operation records erasure metadata after deleting the verdict rows.

​

Zero data retention

With zdr: true, the collector posts to /z instead of /c. Parsed claims remain request-local. A valid ZDR request creates no assessment, identity, projection, NDJSON record, request ID, or retrievable session. It removes the owned per-nonce session and linked state. The edge returns exactly { "ok": true }, and the collector returns { ok: true }. Malformed or incomplete ZDR submissions retain only a hidden, nonpersistable baseline marker. They retain none of the submitted request data.