Privacy notice

This notice covers this website, shorenet.co.uk. It is published by Shorenet Ltd (company number 17010026, registered in England and Wales, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ), which decides how the information described here is used.

How long our servers keep what the Shorenet Trawler application sends is set out below; what it sends is listed in the FAQ.

What we collect, in short

• If you apply for the free evaluation: what you type into the form, and which campaign link brought you, if any. A bot check by Cloudflare runs when you visit the evaluation page, and if you send the form we keep a pseudonymous fingerprint of your IP address for the rest of that day to limit how often the form can be sent (see below).
• If you take the screenshot test: an anonymous count of which panel was picked, per day. Nothing about you.
• Otherwise: nothing that identifies you. This site sets no cookies of its own, and its pages carry no analytics or advertising trackers. Cloudflare’s protection of the site adds a bot-detection script to its pages and may set a security cookie (see Hosting, below), and the bot check on the evaluation page is Cloudflare’s too (see below). Cloudflare, which hosts it, processes your IP address to deliver pages (see Hosting, below).

The evaluation application form

What is stored. Your name, organisation, role and work email; your answers to the three questions on the form; how you heard about Shorenet, if you chose an answer; the time we received it; and the campaign the link you arrived by was tagged with (the utm_source and utm_campaign values in its web address), if it had any. Campaign values are kept only if they consist of letters, digits, dots, underscores and hyphens; anything else is discarded. We do not store your IP address (only the fingerprint described below), browser details, cookies or the page you came from.

The bot check. Before the form can be sent, Cloudflare Turnstile checks that it is being filled in by a person. It runs in your browser when you visit the evaluation page. Cloudflare’s Turnstile Privacy Addendum says the check collects signals including your IP address, your browser’s TLS fingerprint and user-agent, and which website’s check it is; that Cloudflare processes them as our processor to protect this form, and as a controller, relying on its legitimate interests, to improve its bot detection. For the cookies Cloudflare uses, the addendum refers to Cloudflare’s Cookie Policy. We pass your IP address to Cloudflare with the check, and receive back only its result and which site and action it was for, which we do not store.

How often the form can be sent. To limit how often the form can be sent from one connection, we keep, for the day (UTC) on which you send it, a count against a pseudonymous fingerprint of your IP address (for an IPv6 address, of its first half, which identifies your network): a one-way hash made with a secret key. It is not your address. Because we hold the key (and so does Cloudflare, which issues it for the bot check), it could in principle be matched against an address someone already knows, and we do not do that. It is deleted after that day, by the daily job or when the next application arrives.

Why. To assess your application, to contact you about it, to run your evaluation if you take part, and, from the campaign values, to understand which of our messages reach the people who apply. We rely on our legitimate interest in running the evaluation programme, and, once you take part, on taking steps at your request before any contract.

Where it is stored, and who sees it. The application is stored in a database run for us by Cloudflare, which hosts this website. Shorenet’s business inbox is sent an email, through Resend, the email delivery service we use, saying only that a new request arrived: it contains none of the details you entered. The details are read in that database, inside Shorenet’s Cloudflare account, which only people with access to that account can open. Within Shorenet, applications go to the founder, who runs the evaluation programme. We do not sell them, and share them with no one beyond Cloudflare as described here. Cloudflare may process the information outside the UK, including in the United States.

How long we keep it. An application is deleted from the database automatically once it is more than 365 days old: a scheduled job checks every day, and the same check runs when a new application arrives. Notification emails contain no personal details, so nothing about you is kept in the inbox. A deleted application can remain recoverable from Cloudflare’s database backups for up to 30 days after deletion (see below).

The screenshot test counter

On Screenshots as evidence, the panel you pick is added to a daily count of picks per panel and per link source. No individual pick is stored, and nothing in the count identifies anyone.

Hosting

Cloudflare, which hosts this website, necessarily processes your IP address to deliver pages to you and to protect the site from abuse. As part of that protection, Cloudflare adds a short bot-detection script to our pages, which runs in your browser, and may set a security cookie (cf_clearance) recording that your browser passed its checks. We do not store your IP address, and we do not read that cookie or use it for anything. For the cookies Cloudflare uses, see its Cookie Policy.

What the Trawler application sends, and how long we keep it

What the application sends, and to whom, is listed in full in the FAQ. On our servers, the main records of what it sends are kept as follows:

• Diagnostics (only if you switch them on): our live service does not collect them yet. Once it does, individual reports, logs and counters are kept for 30 days and grouped error summaries for 12 months from their last occurrence.
• Records of your capture sessions (which licence, device and account it belongs to, start and end, the relay used, its status, and packet and byte counts): 12 months after the session ends. The job that deletes them automatically is written but not yet running on our live service, so until it is, older records may still be held.
• The relay’s own signed records of a session: the relay software is built to delete them automatically, within a day of their reaching 7 days after the session ended (the default), or 8 days after it started if it never ended.
• Licence checks (when your installation last checked in) and timestamp requests (which licence and account asked, which authority, and when): a retention period is not yet defined.
• Update checks: a check that succeeds leaves no record of its own. One we refuse is logged with the reason and the key, installation and licence it named; a retention period for that log is not yet defined. Our sign-in system may also record when your installation’s key was last used; a retention period for that is not yet defined.
• Your computer’s name and the certificate that identifies its TPM, sent at activation and enrolment: a retention period is not yet defined.

Our Cloudflare (D1) databases hold the evaluation applications and their send-rate counters, the screenshot-test counts, and the records listed above for the Trawler application, except the relay’s own records (kept on the relay) and diagnostic logs (kept in Cloudflare’s file storage). Those databases have point-in-time recovery that lets a database be restored to its state at any moment in up to the last 30 days, so a deleted record can remain recoverable for up to 30 days after it is deleted.

Your rights

Under UK data protection law you can ask us for a copy of the information we hold about you, ask us to correct or delete it, or object to how we use it. To do any of these, use the contact page. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office (ico.org.uk).