Everything this page can see about you

1 What arrived before you saw anything

No JavaScript produced this section. It is the HTTP request: assembled by your browser, your network, and the edge in front of this site.

The raw request

Exactly what this visitor typed or sent, before any of it was interpreted. If a line is missing here that you expected, your browser chose not to send it, and that absence is itself a signal.

GET /privacy HTTP/2
accept: */*
accept-encoding: gzip, br
cf-connecting-ip: 216.73.216.40
cf-ipcountry: US
cf-ray: a4f5bb1c397b0acb
cf-visitor: {"scheme":"https"}
connection: Keep-Alive
host: zpe.vc
user-agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
x-forwarded-proto: https
x-real-ip: 216.73.216.40

Every header, and what it hands over

All 11 headers in the order they arrived. The middle column is the value this request carried. The right column is what a site can do with it. One edit: a cookie value is a credential, so it is replaced before printing. The name and the count stay, because a cookie's name is not a secret and its value has no business on a screen.

Not sent, which is also information

These are the headers a site looks for and this request did not carry. A missing Cookie says you are not signed in. A missing Sec-CH-UA says you are not on Chromium. A missing DNT or Sec-GPC says you have not asked anyone to stop.

dnt sec-gpc referer cookie authorization sec-ch-ua sec-ch-ua-full-version-list if-none-match if-modified-since range

The edge object, unedited

Cloudflare hands the worker this object beside the request. It is printed as it arrived, key by key, including the keys we have no sentence for. This is the whole of what the edge decided it would tell us.

Not exposed to us even though Cloudflare computes it: botManagement, clientTrustScore, clientTcpRttMs, metropolitan_area, place. A score that exists and is not shown is still a score that decided something.

2 The page looks back

Everything above arrived on its own. Everything below needs code running inside your browser, which is why none of it has run yet: this page ships one script, and it waits for a press. What it reads is what any site reads without asking: screen, graphics card, fonts, timezone, storage, sensors, the shape of your typing. It also reads the things that need a prompt, and it will only ask for those if you press the second button.

3 The verdict

Every point of the score, taken apart: what it costs, why, and whether it is yours to change. Then the histogram the ranking is counted from, printed in full, because a number nobody can inspect is a number to distrust.

4 What you cannot change

A short list, because it is short. These arrived with the request, on every site, for the life of the connection. Changing them means changing browser, network, or device, and some of them are not yours to change at all.

5 Who else sees it

This page is not the observer. It is one of about a dozen parties on the path, and it is not the one with the most access. In order, from your device outward.

1. Anything running inside your browser. Extensions, userscripts, a malicious bookmarklet, an injected ad frame. They read the page after it renders, including what you type into it. They are invisible to the server.
2. Your browser itself. It decides which headers to send, whether to use encrypted DNS, and whether to randomise a canvas. It also reports crashes, and in most builds some telemetry, to its own vendor.
3. Your operating system. It resolves names for every app, keeps the timezone, and may run its own telemetry and captive portal checks.
4. Your local network. Router, hotel, office, cafe. It sees every name you look up unless DNS is encrypted, and every address you connect to regardless.
5. Your ISP or mobile carrier. The same, at scale, plus the ability to correlate across every site you visit. This is the party that knows the most about you and is discussed the least.
6. Your DNS resolver. One line per domain, with a timestamp. Encrypted DNS moves that trust to a different company, usually a large one.
7. Transit networks. They see the address and the cleartext server name in the TLS handshake. Not the content.
8. Cloudflare, in front of this site. TLS terminates at their edge, so they see the request in cleartext, exactly as this page does, and they keep their own logs under their own policy. No site behind a CDN can honestly claim otherwise.
9. This worker. The code in this repository, which for this page keeps nothing. Section 9 is the detail, including the one route on this host that does keep something.
10. Our DNS provider and registrar. They publish the fact that zpe.vc exists and which names under it answer.
11. The certificate authority, and everyone. Every certificate issued for a name is written to public transparency logs. That is why a hostname cannot be kept secret, even if it is never linked from anywhere. Check this one: crt.sh/?q=zpe.vc.

Your connection, described by the edge

Fetched from this same origin, so it adds no third party. This is Cloudflare's own summary of the connection it just terminated.

The three sentences that matter here

Your address is not a secret, it is a routing fact. The name you asked for is not a secret, it is a lookup. The content is the only part that encryption actually protects, and only from the parties in the middle, never from the two ends.

6 DNS, and the parts that travel in the clear

Before a single byte of this page was sent, your device asked a resolver for the address of zpe.vc. That question is the most revealing thing most people never think about.

Live: what your own handshake exposed

The sni line in the edge's trace, read from your connection just now. If it says plaintext, every hop between you and this edge could read the name you asked for. Encrypted Client Hello is the only fix, it is per site, and many sites still do not switch it on.

Three tricks built on DNS and caches

Unique subdomains as a cookie

A page asks your device to resolve random.zpe.vc. The resolver logs the random string against your address. No cookie, no storage, no script, and it survives a private window in some setups. Any zone the tracker controls can do this.

Favicon and cache supercookies

A site loads a sequence of images and measures which ones come back instantly. The pattern is a number it can read back later without storing anything on your device. Browsers have narrowed this, and not closed it.

HSTS and preload lists

A site pins itself to https in your browser's own settings, which is a per-site bit that survives a cookie clear. Preload lists ship in the browser build, so membership in one is a small fingerprint of the build you run.

7 Cookies and trackers

A cookie is the only thing in a plain page load that persists between visits. That is why everything else in this section exists: trackers go to enormous trouble to rebuild persistence without one.

Your two cookie lists, side by side

The left column is what the server received. The right column is what JavaScript can read. The difference is the point: HttpOnly hides a cookie from scripts and hides nothing from the server, and the server is the party that set it.

What replaced third party cookies

Third party cookies are blocked or partitioned in every major browser now, so the tracking industry moved to things a site can compute or store for itself.

8 Extensions

An extension is the most privileged code on this page and the only code we cannot see. It runs after the response arrives, in your browser, with access to the rendered page, your keystrokes, your cookies if it was granted them, and every request the page makes. Nothing about it reaches this server.

Why extension detection is unreliable by design

So the honest statement is not "we detected your extensions". It is: an extension is invisible to the server, invisible to the page, and reads everything the page reads. The demonstration in section 2 is the only reliable proof, and it works because the page and the extension have the same view.

9 What we keep, and what this page refuses to do

A privacy page that describes the whole world and not itself is a brochure. Here is this site's own ledger.

What this page will not do

• Load a font, a script, an image or a stylesheet from anyone else.
• Set a cookie, or read one it did not need. The scan reads document.cookie because section 7 would be an assertion otherwise.
• Keep the scan. The result exists in this tab and is gone when you close it, apart from the one score bucket the ranking is counted from.
• Ask for your location, camera, microphone or contacts automatically. Two of the three are refused in the response headers before the page loads.
• Send one byte anywhere. There is no endpoint, and no code to call one.
• Pretend the list above is complete. It is complete about us, and section 10 is where it stops being complete about the world.

10 The full inventory

Every attribute this page read, with the cost of reading it and what it narrows you to. Run the scan and the values fill in. The column on the right is the one that matters: some of these are exact, and some are a coarse guess dressed as a number.

What no page can read in 2026, and why

The other half of "everything". A page that only lists what it can take is selling. Here is the list of things it cannot, with the reason, so you can tell which defences are real.