> ## Documentation Index
> Fetch the complete documentation index at: https://docs.heretic.quest/llms.txt
> Use this file to discover all available pages before exploring further.

# Heretic Privacy: Data Collection, Retention, and Deletion

> What Heretic records at measurement time, where that data lives, how long it is retained, and how to delete records for your sites.

Heretic is a browser-integrity sensor. It measures physical and cryptographic properties of a connection to determine whether a session's declared identity is consistent with its observed behaviour. This page covers exactly what is recorded at measurement time, where that data lives across the edge and dashboard layers, how long each layer retains it, and how you delete records associated with your sites.

***

## What a session records

### Off the connection

Heretic reads the following passively from the wire at the edge, before any JavaScript runs:

* **TCP options** — SYN window size, scaling factor, SACK, timestamps, and option ordering used to construct a transport-stack fingerprint
* **TLS ClientHello** — cipher suite list, extension ordering, supported groups, and ALPN to construct a `tls-construction` fingerprint
* **HTTP/2 framing** — SETTINGS frame values and stream ordering
* **Connecting IP** — used for RTT geometry; not stored in the dashboard (see [Where it lives](#where-it-lives-and-for-how-long))
* **ASN and country** — derived from the connecting IP at the edge; stored as network classification
* **Network classification** — residential, datacenter, proxy, or mobile, derived from the ASN

### Measured on the machine

The `@heretic-hq/collector` script runs active measurements in the browser and sends the results to the edge:

* **Compute** — CPU parallelism workload, microarchitecture inference, and clock resolution
* **GPU** — shader output hashes used to detect GPU class mismatches
* **Parallel timing** — concurrent task throughput versus declared core count
* **Frame timing** — rAF cadence and compositor behaviour
* **Canvas fingerprint** — rasterisation output used for render clustering (disable with `render: false`)
* **Audio fingerprint** — OfflineAudioContext output used for render clustering (disable with `render: false`)

### Declared by the browser

The collector reads the following browser-declared surfaces. Heretic treats every value here as a **claim** to be tested, never as a ground-truth fact:

* `navigator` properties — `userAgent`, `platform`, `hardwareConcurrency`, `deviceMemory`, `language`, `languages`
* `screen` properties — `width`, `height`, `colorDepth`, `pixelRatio`
* `Intl` — resolved locale and timezone
* `navigator.userAgentData` — brand list, mobile flag, platform string
* WebGL renderer and vendor strings

***

## What is NOT recorded

<Note>
  Heretic is intentionally narrow in what it stores. The following are explicitly out of scope:
</Note>

* **No advertising IDs** — Heretic does not read, store, or transmit IDFA, GAID, or any advertising identifier
* **No cookies** — the collector does not set or read cookies
* **No persistent browser storage** — any browser-side session state is short-lived (approximately 15 minutes) and scoped to the edge session
* **High-entropy surface values are stored as shape, not raw value** — canvas pixel buffers, audio sample arrays, and GPU shader outputs are reduced to counts, hashes, or bucket classifications before leaving the edge; the raw values are never written to the dashboard store

***

## Where it lives and for how long

Heretic has three storage layers with distinct retention windows.

<Steps>
  <Step title="Edge memory">
    The full session record — including the connecting IP and all raw measurements — lives in memory on the edge node that handled the connection. It is held for **15 minutes** from the time the session was created. After 15 minutes the record is evicted. This window is why you should call the `explain` endpoint promptly after the collector returns a session ID.
  </Step>

  <Step title="Edge log">
    An append-only structured log is written on each edge node. The retention window is set by the edge operator. The connecting IP is present in this log.
  </Step>

  <Step title="Dashboard store">
    The dashboard persists a compact **verdict projection** for each session: verdict, signals fired, network classification (ASN + country), and timestamps. The raw connecting IP is **not** stored in the dashboard. Dashboard records are swept after **90 days**.
  </Step>
</Steps>

| Layer           | Contains raw IP | Retention    |
| --------------- | :-------------: | ------------ |
| Edge memory     |        ✓        | 15 minutes   |
| Edge log        |        ✓        | Operator-set |
| Dashboard store |        ✗        | 90 days      |

***

## Deleting records

You can delete all session records associated with a site key from the **Keys** page in the dashboard. Deletion is logged with a full audit trail so you have a record of when the deletion was requested and confirmed. The edge log clears on its own schedule — deletion from the dashboard does not purge the edge log ahead of its configured retention window.

For data requests that go beyond the self-serve deletion flow, email [hello@heretic.quest](mailto:hello@heretic.quest) with your site key and the nature of the request.

***

## Device fingerprinting

The `identity.same-origin-cluster` signal is produced by the render family. It clusters a device's canvas and audio fingerprint against other sessions observed on the same origin to detect cases where multiple sessions share an identical rendering environment. This is the only signal that compares one session against others.

If your use case requires you to disable this signal — for example, because your users operate in a jurisdiction with strict fingerprinting rules — set `render: false` in the collector configuration:

```js theme={null}
import { createCollector } from "@heretic-hq/collector";

const collector = createCollector({
  key: "YOUR_SITE_KEY",
  render: false,   // disables canvas, audio, and render clustering
});
```

Setting `render: false` removes the entire render family from the session. All other evidence families — network geometry, transport stack, TLS construction, compute, and declared — continue to operate normally.


## Related topics

- [Heretic Data Retention: Edge Logs and Dashboard Store](/dashboard/data-retention.md)
- [Heretic Dashboard: Manage Sites, Keys, and Verdicts](/dashboard/overview.md)
- [Heretic FAQ: Integration, Verdicts, Privacy, and Access](/reference/faq.md)
- [Heretic API Keys: Collector Setup and Explain Endpoint](/dashboard/api-keys.md)
- [Install and Configure the Heretic Collector for Your Site](/integration/collector.md)