What this site counts
How this site and its API get used is counted in 2 stores. Neither keeps anything that ties a row to a visitor. A douar’s suggested spelling is kept apart, with a key that changes every day.
Every request
Every API call and MCP request is counted once, in Cloudflare’s Workers Analytics Engine. The row holds the route with its codes taken out, or an MCP message’s tool when it called one and its method otherwise, the name an MCP client gives itself, the first word of the User-Agent, the country, the status and how long the request took. That’s the whole row: enough to see how the API gets used, not who used it.
A tool or a method outside a fixed list is stored as “other”, and so is a client name the scrub empties. Cloudflare keeps these rows for 3 months. A static file runs no code, so opening one isn’t counted here.
What’s asked for
A second store, in D1, counts 5 kinds of row: a search, a place opened, a tool an assistant calls through the MCP server, the name an MCP client gives itself, and a file downloaded. A row holds the day, what was asked for, how many results a search showed, the page’s language, the country and the version of the dataset live at the time. It also says whether the User-Agent looks like a crawler’s, and which class of site sent the visitor, such as reddit or a search engine, never the address itself.
The client that made the request is recorded too: “browser” for the site’s own search box and beacon, and the first word of the User-Agent for anyone using the API or MCP directly.
A search
A search is stored lower-cased and cut to 64 characters. It’s dropped completely if it holds an @, a slash, anything shaped like a web address, more than 6 words, or 6 digits or more however they’re written, unless those digits spell out a real place’s code. That’s how an email or a phone number typed into the box by mistake stays out.
The site’s own search box reports a search once it’s settled: 1.5 seconds after the results stop changing, or as soon as one is opened, never on every keystroke. With the browser’s Do Not Track on, the search box reports no search and the beacon notes no place or file opened. The box still asks the API for its results, and Analytics Engine counts those requests like any other API call, without what was typed.
What’s kept
A row is a day and a handful of categories, the kind a tally needs. No row holds a key, a cookie or an address that ties it to another.
The demand log’s raw rows are deleted after 90 days. What’s left is counts by day, which the most looked-up page is built from. A search keeps its words in that count only when they’re a place’s name or code, or were typed 3 or more times that day; otherwise only the count stays. The rule counts rows, so the 3 can all come from one visitor.
A suggested spelling
A douar’s page takes a Latin spelling for a douar no source names in Latin. Each night the spelling engine checks what’s been suggested, and shows a spelling 2 visitors suggested if it reads close enough to the douar’s Arabic. To tell 2 visitors apart, a suggestion is kept with a key made from the visitor’s address and a secret that changes every day: the same address gives the same key on one day and a different one the next, and the key can’t be turned back into the address. The address itself isn’t kept.
A suggestion holds the douar, its Arabic name, the spelling, the key and the day, and is deleted after 90 days. A spelling that’s gone live is kept with the douar and the day it went live, and nothing about who suggested it.
All of this is public, in the source.