Watch Floor

Privacy policy

Last updated November 6, 2026

Watch Floor (watchfloor.fyi and world.watchfloor.fyi) is a free, independent, personal project. It has no advertising, does not sell or share personal information, and does not build profiles of visitors. This page lists everything it does keep.

If you just read the site

  • Visitor counts. To count real readers rather than bots, each page reports a view once it has been visible for about a second. The report holds the page path, the site that linked you (its host name only, e.g. linkedin.com), and a random ID your browser keeps in its local storage. Watch Floor stores only a one-way hash of that ID, your country as Cloudflare reports it, whether you are on a phone, tablet or desktop, whether you were signed in, the time of your first and last view that day, and the number of pages viewed. It never stores your IP address for this.
  • Global Privacy Control and Do Not Track. If your browser sends either signal, no ID is kept in your browser. You are counted for that day only, through a hash of your IP address and browser name made with a random value that changes every day and is deleted within two days, so your visits cannot be linked across days or back to you.
  • PDF downloads are counted the same way (the daily, non-reversible hash), once per reader per day.
  • Browser storage. The site keeps a few things in your browser's local storage: the visitor ID above, when you last visited (to mark new items), filter choices, and your recent lookups on the Lookup page. The lockfile checker keeps its notes in session storage, which your browser clears when you close the tab. None of it is sent anywhere except the visitor ID's hash as described. Clearing your browser's site data removes it.
  • Phone alerts. If you turn on alerts, your browser gives Watch Floor a push address (a URL at your browser maker's push service: Apple, Google, Mozilla or Microsoft) so alerts can be delivered. It is stored until you turn alerts off, the push service reports it gone, or delivery fails 20 times in a row. The alerts themselves go through that push service.
  • Lockfile checker. When you check a lockfile on the Check page, the package names and versions are sent to OSV.dev (run by Google) to look up known vulnerabilities, and the report is kept for 30 days so it can be shared by link. Nothing else about you is attached to it.
  • No cookies are set for visitors.

If you have an account

  • Account: your username, a salted PBKDF2 hash of your password (never the password itself), your role, the note you wrote when requesting access, and when you signed up, were approved and last signed in.
  • Sign-in session: one HttpOnly, Secure cookie. The server keeps only a hash of the session token, its expiry, when it was last used and your browser's user-agent string (so you can recognise your sessions).
  • Work you do on the site: triage states and notes, saved searches and their alert settings, and incident pages you create, each with your username.
  • Abuse protection: failed sign-ins and sign-up requests are counted per username and per IP address for 15 minutes; these records are deleted after a day.

If you contact Watch Floor

Messages sent through the contact form and access requests are delivered to the site owner's private Discord channel, with the topic, name and reply address you choose to give (nothing else about you is attached). Watch Floor does not store contact messages; Discord keeps them under its own privacy policy. To stop abuse, contact attempts are counted against a hash of your network address made with a secret value that changes daily (never the address itself), cleared daily.

Services involved

  • Cloudflare hosts the site (Workers, D1 database, CDN) and, like any web host, processes your IP address and request details to deliver pages and stop attacks. See Cloudflare's privacy policy.
  • Discord receives contact messages and access requests (above).
  • OSV.dev receives package names and versions from the lockfile checker, and browser push services deliver phone alerts (above).
  • PayPal handles donations if you choose to give through the Support page; Watch Floor sees only what PayPal reports to the recipient.
  • AI summaries on the site are written by models running on Cloudflare Workers AI and Anthropic's API from public vulnerability data. No visitor or member data is sent to them.
  • Links lead to vendors, governments, researchers and news sites, each with their own privacy practices.

How long it is kept

  • Visitor counts: 13 months, then deleted (checked daily).
  • Phone-alert push addresses: until you turn alerts off, the push service reports them gone, or after 20 failed deliveries.
  • Lockfile check reports: 30 days.
  • Account data and the work you do on the site: until your account is deleted. Ask through the contact form to have it deleted; triage notes and saved searches go with it.
  • Sessions: until they expire (30 days) or you sign out.
  • Sign-in rate-limit records (which include IP addresses): one day; they are cleared daily.

Your choices and rights

You can browse without an account, block or clear local storage, or turn on Global Privacy Control. You can ask what is held about your account, have it corrected or deleted, through the contact form. Visitor counts are not linked to any name or account, so they cannot be looked up for an individual.

Children

Watch Floor is a professional security resource and is not directed at children under 13. It does not knowingly collect information from them.

Changes

When this policy changes, the date at the top changes too. Significant changes are noted on this page.

Questions: use the contact form.