Research and privacy notice

What is measured

The study records marketplace-page and listing-detail requests, timestamps, requested paths, referrer information, coarse browser-header consistency, limited interaction counts, boolean browser-automation indicators, and attempts to reveal synthetic seller contact numbers. Contact-access logs contain an internal listing key and time, not the phone-number value. Public listing URLs use opaque HMAC tokens. Raw canvas, audio and font fingerprints are not collected.

Pseudonymous processing

Session, network and browser signals are transformed with a server-secret HMAC. A CohortId identifies a technical request cohort for the experiment; it does not identify a person, company or legal entity. Raw IP addresses are retained separately as protected operational security data so abusive traffic can be correlated and rate-limited across cookie resets; they are excluded from model-training features and ordinary public output.

Optional accounts and contact access

Visitors may browse without registering. Anonymous cohorts may reveal up to 20 unique synthetic numbers in 24 hours. Optional accounts use a username and securely hashed password and may reveal up to 100 unique numbers in 24 hours across all signed-in devices. Account identifiers connect those sessions for rate and risk measurement; no email address is requested.

Synthetic research records

The server may return synthetic research records, including non-visible HTML source records alongside catalogue results. Delivery is recorded as exposure only. Stronger collection claims require a later interaction or controlled downstream observation.

Retention and access

Public-deployment telemetry is retained for the configured research-retention period, normally 30 days, and research dashboards and exports require a secret access key. Results should be published only in aggregate form.

Participation

Do not enter personal or sensitive information. Human-subject data collection should begin only after institutional ethics approval, an approved participant notice and a documented withdrawal/contact procedure are in place.