Privacy and retention

Heretic collects browser claims and direct measurements after your application starts the collector. Ordinary and zero-data-retention collections have different data contracts.

Data used for an assessment

Browser claims

The collector sends the browser, platform, display, timezone, hardware, rendering, and capability values used by current rules.

Browser measurements

Compute, rendering, canvas, WebGL, audio, and font measurements record work performed during the session.

Connection measurements

The measurement edge observes the source address and available TCP, TLS, HTTP, QUIC, and timing properties of the collector connection.

The collector does not read application cookies or create advertising identifiers. The public site key assigns the result to a Heretic site.

Ordinary collection

A successful ordinary collection creates an assessment and returns a request ID. The matching server key can retrieve the verdict immediately. The dashboard can also display detailed session evidence while that evidence remains available.

Ordinary results can include deterministic browser and machine identifiers. Each value is scoped to the public site key and identity version. Matching values mean that the same normalized components produced both identifiers.

Zero data retention

Set zdr: true when the collection must leave no retrievable result. Success returns {"ok":true}.

No assessment or identity result is created.
No request ID is returned.
No dashboard or tenant API record is created.
The collection cannot be retrieved later.

Site deletion

Revoking a key stops future use of that key. Retiring a site disables its active keys. Deleting a site removes its stored tenant-facing verdict data.

Manage sites and keys

Send data questions and deletion requests to hello@heretic.tech.