What siteread sends, and what it never does
Your log holds your visitors' IP addresses and every URL on your site. None of that leaves your machine. The one thing that can leave is a week of totals, and only when you say yes.
On your machine
Nothing is sent except plain GETs of public crawler lists, with the user-agent siteread/0.2.1. There is no reverse-DNS check either: a PTR lookup would send your visitor's IP to your resolver.
Only on a yes
It prints every byte it would send, then asks. --dry-run prints and stops. What it sends is exactly what it printed.
Public data, on by default
The CLI gets every vendor's IP list from one file at api.siteread.dev, one request instead of nine, and from the vendors themselves whenever that fails. --no-feed skips it. The service counts fetches per day and the siteread version that made them; nothing about who.
A whole share, byte for byte
From the test site. Thirteen numbers for the last 7 days, a week label, the version, a random id, and the id's proof of work.
{
"schema": 1,
"id": "3803e566762f2e56ba381b993ddf466e",
"week": "2026-W42",
"siteread": "0.2.1",
"metrics": {
"people": 4,
"peopleFromSearch": 1,
"peopleFromAi": 0,
"peopleFromSocial": 2,
"aiAnswerFetches": 0,
"aiSearchFetches": 0,
"aiTrainingFetches": 2,
"searchEngineFetches": 8,
"aiSpoofedPct": 25,
"gscImpressions": 238,
"gscClicks": 3,
"gscCtrPct": 1.3,
"gscPosition": 17.9
},
"proof": "2746561"
}Never sent
- hostnames, URLs or paths
- visitor IP addresses
- user-agents and referrers
- search query text
- your goal names
The payload is built from a fixed list of numbers, and the service refuses any field it does not know rather than dropping it.
What the service keeps
The share as sent, plus the day it arrived (not the time). Not your IP address: the code never reads it, and api.siteread.dev, where shares and the feed go, keeps no log. Per day it counts requests by route and by kind of client (siteread and its version, a browser, anything else); it keeps no user-agent string.
What gets published
Per number, the 25th, 50th and 75th percentile once 10 anonymous sites report it, and how many sites shared each week. Never an anonymous site's row, never an id. synacl.com and siteread.dev are named, with their own numbers, because their owner chose that.
Your id
128 random bits in .siteread/share-id, made the first time you share. It lets the benchmark count sites instead of shares, and a second share of the same week replaces the first. Delete the file to start over as a new site. Its first share also carries a proof of work tied to the id, a few seconds of computing once: made-up sites cost real time, so nobody floods the benchmark for free, and no address is needed to stop them.
This site
No cookies, no analytics scripts, no third-party requests: the fonts are served from siteread.dev itself.
Like the sites siteread is made for, siteread.dev keeps an ordinary access log of its pages: each request's address, time, page, referrer and user-agent. Only root can read it on the server. Once a week its owner copies it to their own machine and runs siteread on it, to see who read this site. Every line is deleted after 28 days, in both places. It is never shared or sent anywhere else, and api.siteread.dev keeps no log at all.