Cookies and analytics

Public website and language choice

The current public website and stateless HTTP MCP do not set an application session or analytics cookie. The site does not currently use localStorage or sessionStorage. Language is expressed in the English/Chinese URL and current page state; it is not forced by IP location.

This absence of application cookies does not remove network-level IP and connection logs. Search URLs can also remain in your browser history or in warning/error diagnostics; see the privacy notice.

Controlled local/SSH trial cookie

The controlled trial can set tdm_session for /api with Max-Age=3600, HttpOnly and SameSite=Strict. It identifies a short-lived trial session for CSRF-protected optional writes and first-party observations. The trial cookie is not a vendor login or a verified identity.

The current local/SSH trial uses local HTTP and the cookie does not carry the Secure attribute. Do not treat this development mechanism as production authentication. The public HTTPS service does not issue this cookie. You can clear or block it in browser settings; optional trial writes will then be unavailable.

First-party observation scope

Controlled-trial event buckets count discovery activity using daily salted session digests and a minimum publication threshold. They do not track cross-site activity, store vendor execution logs or establish unique people. Public HTTP MCP does not manufacture sessions or write those session-based events; completed tool calls can contribute to separate request counters without sessions.

There are currently no advertising cookies, third-party analytics scripts, cross-site marketing profiles or real affiliate callbacks. If optional tracking is introduced, its purpose and controls must be explained before collection and any required consent obtained.

Request counters without cookies

Independent first-party memory counters record instrumented page/search/detail/compare events, completed MCP tool-call categories and allowlisted outbound redirects. Successful feedback and the legacy click-submission endpoint are limited to the controlled trial. Coarse User-Agent classification is transient; its raw text and raw queries, IPs, session identifiers and fingerprints are not stored by this module. This does not eliminate the separate server logs explained in the privacy notice.

Public request buckets require at least five unclassified events for the same UTC-day/channel/action. They do not establish five people or five sessions, and the threshold is not an anonymity guarantee. Counts reset on restart and expire within the rolling 30-UTC-day window through read/write and minute-timer cleanup. Tests and bots cannot be completely identified; there is no historical backfill.

Separate software-interest counters store registered MCP-software IDs and search-result appearances, detail reads and allowlisted integration redirects. Their public threshold is five combined unclassified events per software within the selected seven/30-day window, not five per day or five sessions. They are also memory-only, reset on restart and are distinct from the older session-based observations. A redirect does not fetch or proxy the vendor, and direct external links in server-rendered pages are not all measured. Bookmark counts remain null because the feature is not implemented.

Operator and contact

南京定义未来科技有限公司
Nanjing Define Future Technology Co., Ltd. — reference translation; not a verified registered English name

Customer service and privacy requests: service@deffuture.com