what this server records

One small program serves every page here, and this page is that program telling you what it wrote down about your visit. The answer is short enough to state plainly.

recorded

For each request the server writes one line to its own journal. That line holds your IP address, the path you asked for, the HTTP method, the response status, how long the request took, and whether you carried a valid session. When you solve the proof of work, the line also records the time the puzzle took to solve.

The journal exists for two reasons: a break-in must be reconstructable, and abuse must be visible. It lives on the server, in the system log, and nowhere else.

A page that does not exist carries a small random marker in its HTML, unique to that one 404. If the marker ever comes back to the server inside a later request, the server writes an alert to its journal. The only way to send it back is to have copied the page text and echoed it, which no honest browser does, so the alert is the signature of something between you and the server that reads what passes through.

not recorded

There is no tracking pixel, no third-party analytics script, no advertising identifier, and no fingerprint of your browser. The pages carry no script at all once the puzzle is done, so there is no code that could report back to anyone.

The only durable thing your browser keeps is the session cookie, and it says less than most cookies. The cookie is an expiry time plus a signature. It proves you passed the proof of work, and it says nothing about who you are. It is not shared across sites, it cannot be read by any other domain, and it stops meaning anything within 24 hours.

The journal is capped at 60 days and then forgotten. No analytics company and no advertiser sees any part of it, because the log never leaves this server.

encrypted

Every connection arrives over TLS 1.3 using the hybrid post-quantum key exchange X25519MLKEM768. The handshake combines the classic X25519 with ML-KEM, the lattice scheme NIST standardized in 2024, so a machine that records today's traffic cannot decrypt it later with a quantum computer. A client that does not offer the hybrid still connects over X25519. Nothing old is shut out, and nothing current is left weak.