Privacy Policy

CreepJS demonstrates how browser fingerprinting works by running collectors in your browser (Canvas/WebGL/Audio/Navigator/Storage APIs and more) and presenting the results in a human-readable format.

The project is intended for education, security research, and legitimate use cases (e.g. fraud prevention). You should always follow applicable laws and disclose fingerprinting usage in your own products.

The Terms of Use define the project's responsible-use boundaries.

For reviewer-level storage traceability in the repository, see the data traceability matrix in `docs/SECURITY.md`.

In the browser: fingerprint components are computed locally to generate a fingerprint ID and to render the on-page report.

On the API: the API is designed to be stateless with respect to fingerprint payloads. It validates requests and returns responses, and it maintains minimal operational state for abuse prevention.

• API tokens (email, createdAt, usageCount) are stored in Cloudflare KV.
• Rate limit counters are stored in Cloudflare KV with a time-based reset window.
• The optional “My IP” feature uses the same server-side IPbot integration as the public IP checker and caches the response in KV for a short TTL.

CreepJS does not intentionally store raw fingerprint component payloads long-term.

If enabled by the site operator, CreepJS can use Cloudflare Web Analytics (privacy-first, cookie-less). Analytics can be disabled by not setting the public analytics token.

The current product analytics events are limited to high-level product usage signals: checker runs, IP risk lookups, API token requests, playground API tests, docs section views, code-example copy actions, and major CTA clicks.

• No email addresses are sent to analytics.
• No fingerprint IDs, raw fingerprint payloads, or IP lookup response bodies are sent to analytics.
• Page and link analytics are normalized to path-level URLs to avoid leaking query parameters.
• The analytics beacon is skipped when Do Not Track is enabled.

If your jurisdiction requires consent for analytics or fingerprinting, you must add that consent layer in your own deployment before enabling those features.

If you do not want to be fingerprinted, you can close the site or use privacy-focused browsers and settings that reduce fingerprintability.

Signals like Do Not Track and Global Privacy Control are part of the privacy posture, but they do not replace your own product-level compliance review.

For background and technical details, see the documentation and the browser fingerprinting guide.