# What data we collect

> Exactly what Buff records about how the product is used, what it does not record, and where to see it.

Buff counts **what gets used and where people stumble**. This page is the complete list of what is recorded, because “we respect your privacy” means nothing without a list.

## Two counters, and they are different

| | Public site | Product |
|---|---|---|
| What it counts | page views, where visitors came from, device type | actions in the app, screens, service responses |
| Who is in the record | nobody: the visitor is anonymous | login and organisation — for registered users |
| Where it lives | our server next to the site | our data warehouse |
| Cookies | sets none at all | not applicable |

The site counter is our own, hosted on our servers. It sets no cookies and **does not store the IP address**: visitors are told apart by a value computed from the address, the browser and the domain with an irreversible transformation whose key changes every day. It can be used neither to identify a person nor to link their visits on different days.

## What is recorded about work in the app

- **Action** — which command was executed: sign-in, creating a draft, a review decision, an “Ask” question. Both successful and rejected ones: refusals show where people hit a wall.
- **Who and where** — login and organisation. Without a login we cannot answer “it doesn’t work for me”, nor count how many people actually use the service.
- **How long it took** — processing time, to see what has become slower.
- **Screens** — which section was opened and from which device. Task and question identifiers do not go into this record: two opened tasks are one “task” screen.
- **Deliveries** — that an email or notification was sent (or was not, and with which error code).

## What these records do not contain

- The content of tasks, questions, research and conversations.
- Code, diffs and file names from your repositories.
- IP addresses and browser strings — these exist only in the [audit log](/en/docs/audit-log), which has a different purpose: the organisation’s security.
- The text of search queries: the length of the query and whether anything was found are counted, but not what was searched for.
- Any values you type into forms.

This is not a promise but a property of the storage: the attribute field accepts only short values — a number, a flag, a short label. A nested structure through which text could leak is rejected at the input.

## Reads by machines

Robot requests to `llms.txt` and to the pages’ markdown mirrors are counted separately and **by agent class** — AI agent, search crawler, utility. The browser string itself is not stored.

## How long it is kept

Statistics records are kept for at least 400 days — a year plus the ability to compare with the same period of the previous year.

## Where to see it

The service operator sees a summary in the “Usage” section of the admin panel. Your organisation’s data is not split out into a separate view for you — if you need one, [write to us](/en/contact).

The legal side is in the [Personal Data Processing Policy](/en/legal/privacy), clauses 4.1 and 4.4.