What we collect, and what we don’t

If you use the contact form

The contact form is the only place on this site where you can send us anything. When you submit it, we receive exactly the fields you filled in: your first name, last name, email address, the topic you chose, a subject, your message, and — if the topic is about a specific bot — the bot’s name. If you arrived from a bot’s page, the form also passes along the path of that page so we know what you were looking at.

That submission becomes one email to our support inbox and nothing else. It is not written to the Bot WHOIS database, it does not create a record in the registry, and it is not added to any mailing list. Your email address is set as the reply-to on that email so a person can answer you directly. We use it to reply to you and for nothing else.

The email is delivered by Resend (resend.com), a transactional email provider in the United States, which processes it on our behalf in order to deliver it. Your message then lives in our support mailbox like any other email we receive.

The form does not read or transmit your IP address. Our servers and our CDN necessarily see it in order to serve you the page at all — that is described below — but it is not collected by the form, not attached to your message, and not sent to Resend.

Analytics

We measure how the site is used with our own analytics, plus the two services described below, none of them an advertising product. There are no cookies. Instead the site stores two random identifiers in your browser’s local storage: one that lasts for the browser session, and one that persists so we can tell a returning visitor from a new one. They are random values with no meaning outside this site, and because browser storage is per-origin they cannot be used to follow you anywhere else.

Each pageview sends us:

• those two random identifiers, and the page path you viewed
• the hostname of the site that linked you here, if any — the domain only, never the full referring URL
• any campaign tags (utm_…) present in the link you followed
• your browser window width, whether it is a mobile browser, and your connection type
• page-loading speed measurements
• how many times you have visited, which page you entered on, and how long since your first visit

It does not collect your name, your email address, your IP address, or the contents of anything you type. The data goes to our own infrastructure, hosted on Cloudflare, and is used to understand which parts of the registry people actually use.

We also load Google Tag Manager as a container for site scripts, and it runs one tag: Google Analytics. That measures page views the same way our own analytics does. It sets its own identifiers in your browser and reports what page you viewed, your approximate region, and your browser and screen details.

Both the container and its measurement travel through our own domain rather than Google's. Our servers make the onward request to Google, so Google sees our infrastructure rather than your IP address for those requests. One small session request still goes directly to google-analytics.com; it carries no page details.

We also use PostHog (posthog.com), a product analytics service in the United States, to see how people use the site and to find what is broken. It records the pages you view, what you click and how far you scroll (shown to us as heatmaps), errors the page hits in your browser, page-loading speed, and a recording of the page as you use it, so we can replay a visit and see where it went wrong. Anything you type is hidden in those recordings, including everything in the contact form; the text of our own pages is visible in them. It also records which features you use, such as a filter, a sort order or a copy button, but never what you searched for, picked, copied or opened. If an AI assistant in your browser uses the tools this site offers it, PostHog records which tool was called, how long it took and the model name the assistant reports, never what it asked for or got back. PostHog keeps its random visitor identifier in your browser’s local storage, not in a cookie. Its requests go through our own domain, and our server passes your IP address on to PostHog so it can estimate your country.

If you would rather not be counted by our own analytics, any content or script blocker that blocks cdn.searchactions.com will stop it, and browsing with JavaScript disabled stops it entirely. Because the Google tags now load from our own domain, blocking googletagmanager.com no longer stops them; blocking botwhois.org/gwz1/ does, and a blocker that recognizes Google Analytics by name will also stop the measurement. Blocking botwhois.org/fx/ stops PostHog. Clearing your browser storage for this site removes the first-party identifiers, PostHog’s included.

Hosting and logs

The site is served through Cloudflare as a CDN and runs on a server in Virginia, in the United States. Both necessarily see your IP address and request headers in order to deliver pages to you and to protect the site from abuse. This is inherent to how the web works rather than something we collect deliberately, but it is true and you should know it.

Our application logs record errors and the shape of traffic — which endpoint, what went wrong — and are used for debugging and abuse prevention.

Some bot profiles display an operator logo supplied by icon.horse or Google Favicons. When a logo appears, your browser requests that image directly from the named provider, which receives the network information needed to return it, such as your IP address and browser headers. We send no referring page address with these image requests.

What we never do

• We do not sell, rent, or trade personal information.
• We do not run advertising or embed advertising or social-media trackers.
• We do not set cookies.
• We do not require an account, and there is nothing to sign up for.
• We do not use anything you send us to train models or to build a marketing profile.

Bots listed in the registry

The registry itself describes automated clients — crawlers, scrapers, and agents — and the organisations that operate them. That information comes from public sources: published IP ranges and user-agent documentation, operator websites, public datasets, and observed crawler traffic. It is information about software and companies, not about individual people.

If you operate a bot we have listed and something about the entry is wrong, the fastest fix is the correction form. Our methodology explains how entries are built and rated.

Your choices

Because we hold nothing about you unless you wrote to us, in almost every case there is nothing of yours for us to hold. If you have sent us a message and you want a copy of it, want it corrected, or want it deleted, email us and we will do it. Depending on where you live you may have a formal right to ask for these things; we would rather just do it than argue about which law applies.

Write to [email protected], or use the contact form.

Changes to this page

If we change what the site collects, we change this page in the same release. The date at the top is when it last changed.