Privacy

Introduction

To tell a bot from a person, NiceTryBot has to look at every request, and some of what it looks at, such as an IP address, is personal data. We think you should know exactly what NiceTryBot keeps, for how long, and where it goes, so this page spells it out.

Because NiceTryBot is self-hosted, the data it collects lives on your servers and in your database. You decide how long it is kept, and you are the one your visitors trust with it.

Note

This page describes how NiceTryBot handles data. It is not legal advice. If you are subject to the GDPR or similar laws, you are the controller of the data NiceTryBot collects on your behalf, and you should review your obligations with someone qualified to advise you.

What Leaves Your Servers

Nothing NiceTryBot collects about your visitors is sent to a third party. IP addresses are geolocated using local DB-IP Lite databases, which are downloaded once a month, so no lookup ever leaves your server.

NiceTryBot only makes the following outbound requests:

Request	What is sent
TLS certificates	Your domains' hostnames, to Let's Encrypt or ZeroSSL.
Location databases	Nothing about your visitors. The databases are downloaded once a month.
Release check	Nothing about your visitors. Turn it off with `NICETRY_UPDATE_CHECK=false`.
Licence check	Only if you have entered a paid add-on's key: the key's ID, once a day.
Plain English search	Only if you add an Anthropic API key: your question, the search or rule you are editing, and your team's hostnames, sent to Anthropic using your key.

What NiceTryBot Stores

Requests

For every request that reaches the edge, NiceTryBot stores:

The time, domain, path, method, status, response time, and the edge's action and tag.
The visitor's IP address and user agent.
The visitor's JA3, JA4, and JA4H fingerprints, client hints, and Accept-Language header.
The visitor's network, its ASN, and an approximate location: country, region, and city.

Query strings are not stored with requests. Full IP addresses are kept because rules and bans depend on them.

Gym Visits

When a visitor is sent to the bot gym, NiceTryBot stores the visit: the visitor's IP address, user agent, JA4 fingerprint, client hints, country, and network, the site and address they asked for, including the query string, and their progress through each obstacle.

Add-on Data

Some add-ons store data of their own:

Add-on	What it stores
Captchas	Whether each answer passed or failed. The answer itself is discarded.
Fingerprints	A device fingerprint, taken only inside the gym.
Request Monitor	Captured requests and responses on the routes you choose, with sensitive values redacted. Passwords are never stored, only their length. Captures are kept for one day, or 30 days if flagged.

Every add-on that stores visitor data is required to follow your retention settings and erasure requests, even while it is turned off.

The Edge's Access Log

The edge writes every request to a rolling access log on your server before it is imported. This log includes the full URL, but Cookie and Authorization values are always redacted. Query strings are dropped and sensitive values are redacted before each line is imported. The log rolls over at 100 MB and keeps the last ten files, so older lines expire on their own.

Retention

Each team decides how long its visitor data is kept from the Visitor data page in the cog menu. You may choose anywhere from 1 to 730 days. The installation-wide defaults are:

Data	Default
Requests	90 days
Gym visits	90 days
Tags and bans	30 days after they end

Administrators may change these defaults using the following environment variables:

.env

VISITOR_DATA_REQUEST_DAYS=90
VISITOR_DATA_GYM_DAYS=90
VISITOR_DATA_VERDICT_DAYS=30

NiceTryBot deletes expired data every hour. Client labels you create are kept until you delete them.

Erasing a Visitor

If a visitor asks you to delete their data, use Erase this visitor on the Visitor data page. You may find a visitor using the reference shown on the gym's page, their IP address, or their JA4 fingerprint.

Erasing a visitor deletes their requests, gym visits, captcha answers, fingerprints, tags, bans, and labels, then records that the erasure happened using a keyed hash rather than the visitor's details. The edge's rolling access log isn't affected, but it expires on its own.

Warning

Only erase by JA4 fingerprint when the fingerprint belongs to a bot. Everyone using the same browser build shares a JA4 fingerprint, so erasing a common one would erase many people's data at once.

Cookies

NiceTryBot never sets analytics or advertising cookies. The gym and the Lockdown add-on set the following cookies, which are strictly necessary for them to work:

Cookie	Purpose	Expires
`_q_session`	Keeps track of a visit to the gym.	After 15 minutes of inactivity.
`_q_pass`	Remembers that a visitor passed the gym.	After the routine's pass time, from one minute to one week.
`_q_pass_k`	Lets an administrator through a lockdown.	After 12 hours.

Telling Your Visitors

Your site's privacy notice should mention that you use bot protection. A short paragraph is usually enough, such as:

Security and bot protection. To keep this site available and to stop automated abuse and fraud, we process technical information about each request, including your IP address, approximate location, browser details and how your browser connects. We keep this information for up to 90 days.

If you would like visitors to be able to reach you about their data, set Contact for visitors on the Visitor data page. It is shown beneath the gym's challenges, along with a reference the visitor can quote when they get in touch.

Writing a Privacy Notice Using AI

Your agent can draft a privacy notice paragraph that matches your actual settings. Give it the following prompt:

Read https://docs.nicetrybot.com/docs/0.x/privacy.md. My NiceTryBot installation keeps requests for [N] days and gym visits for [N] days, and I use these add-ons: [list]. Draft a short, plain-English paragraph for my site's privacy notice that describes the bot protection accurately. Don't claim anything the docs don't support.

Privacy Mode

The free Privacy mode add-on redacts the control panel before you share your screen. It swaps your hostnames for stand-ins, masks IP addresses to their first two parts, such as 193.148.x.x, and hides any words you list in Settings → Privacy. You may toggle it from the top bar or by pressing ⌘ + /.

Privacy mode only changes what the control panel displays. It does not change what NiceTryBot stores.