Privacy Policy
Effective date: 3 September 2026
In short: detectincognito.com is a small static site run by one person: a single-page incognito check plus guide pages in 15 languages. It has no accounts, no forms, and no database of visitors. The incognito check runs entirely inside your browser and its result is never sent anywhere. Four outside companies receive data when you visit: the host, DigitalOcean (New York), and its CDN, Cloudflare (which sets one short-lived bot-detection cookie); Ahrefs Web Analytics (a cookieless page-view counter); and Google AdSense (ads, which may use cookies). That is the whole list.
This policy covers https://detectincognito.com, including its guide pages in every language. It is written to be true of this site, not a template.
Who runs this site
Joe Rutkowski, an individual based in the United States, operates detectincognito.com and is the data controller for it. I have not appointed an EU or UK representative or a data protection officer.
To reach me privately, email [email protected]. You can also open an issue at https://github.com/Joe12387/detectIncognito/issues (public) or use https://joe12387.com/.
What the site itself collects
Nothing directly. There are no accounts, forms, comments, newsletters, or search boxes, and the site reads no URL query parameters. There is nothing you can type into it, and I hold no database of visitors. There is no server-side application: every page is a static file built in advance. The site's own code sets no cookies. Apart from the temporary storage the incognito check uses (next section), the only things the site's own code does on your device:
- Scroll position. The page framework (TanStack Router) keeps your scroll position per page in sessionStorage so the Back button lands where you left. A second sessionStorage key is set only if a script fails to load, to prevent a reload loop. Both are cleared when the tab closes and contain no identifier.
- "Copy code" buttons on code samples write the sample to your clipboard when you click them. Nothing is read from your clipboard.
The incognito check runs in your browser
When a page loads, the open-source detectincognitojs library (MIT, https://github.com/Joe12387/detectIncognito) runs in your browser. It works by probing how your browser's storage behaves: depending on the browser it creates and immediately deletes a temporary IndexedDB database, calls navigator.storage.getDirectory(), or sets and removes a single localStorage key named test. It also reads your user-agent string, touch-point count, and whether the browser is Brave. The full mechanism is described at detectincognito.com/how-it-works.
The result ("private" or "not private", plus the browser name) is shown on screen and held in page memory only. It is never sent to me, to Ahrefs, to Google, or to any server, and it is not written to storage or the URL. The library makes no network requests of any kind. Because this is the function you came here to use, no consent is needed for these temporary storage operations; nothing persists after the test finishes.
One edge case: on Chromium-based browsers the timing test can take up to about a second. If you close the tab mid-test, the temporary database (named __di_ plus random characters) may be left behind. It contains only throwaway bytes, and you can clear it with your browser's "clear site data" control.
Hosting: DigitalOcean and Cloudflare
The site is served by DigitalOcean App Platform (DigitalOcean, LLC, Broomfield, Colorado, USA) from its New York region. DigitalOcean routes App Platform traffic through Cloudflare's global CDN, so copies of the pages are cached at Cloudflare edge locations around the world and your request is answered by the one nearest you.
Like any web host, DigitalOcean and Cloudflare receive your IP address and request headers (browser, page requested, time) in order to deliver the page and block abuse. Cloudflare sets one cookie, __cf_bm, for bot detection; Cloudflare states it expires after 30 minutes of inactivity and its contents are encrypted and readable only by Cloudflare (Cloudflare cookies). I do not control this cookie.
I have no access to per-visitor logs from either company, and DigitalOcean documents no access logs for static sites. I cannot tell you what request data they retain internally or for how long; their own documents are:
- DigitalOcean privacy policy: https://www.digitalocean.com/legal/privacy-policy and data processing agreement: https://www.digitalocean.com/legal/data-processing-agreement
- Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/
DigitalOcean acts as my processor under its DPA and lists Cloudflare as its sub-processor for App Platform CDN and security (DigitalOcean sub-processors).
Ahrefs Web Analytics
Every page except the 404 page loads a small script from https://analytics.ahrefs.com/analytics.js (Ahrefs Pte. Ltd., Singapore). I use it to see, in aggregate, how many people visit, which pages and languages are popular, and where visitors come from, so I know what to improve.
What your browser sends to Ahrefs, based on my reading of the script as served on the effective date:
- On each page view: the page URL and title, the referring URL (if any), your browser language(s), screen width, height and pixel ratio, and this site's Ahrefs key.
- When you click a link: the same, plus the clicked link's URL and whether you held a modifier key.
- With every request, as with any HTTP request: your IP address, User-Agent string and Accept-Language header.
- If the script itself throws an error, the error message and stack trace (not page content).
What it does not do (verified by reading the script): it sets no cookies, writes nothing to localStorage, sessionStorage or IndexedDB, and generates no client-side identifier. It does not check Do Not Track or Global Privacy Control signals.
What Ahrefs states about its side (About Ahrefs Web Analytics): it uses the IP address to derive country and city and to compute a same-day hash of a daily-rotating salt, IP address and user agent for counting unique visitors; the raw IP address is never stored; the salt is deleted every 24 hours; and it does not track individuals across devices, websites or days. Ahrefs's privacy policy states that personal data it holds is stored in the United States (Ahrefs privacy policy). Ahrefs publishes no retention period for aggregated analytics data. I cannot verify server-side handling; these are Ahrefs's statements. The reports I see are aggregate counts by page, country, browser and similar dimensions.
There is no built-in opt-out. If you would rather not be counted, a content blocker or a rule blocking analytics.ahrefs.com stops the script entirely; the site works without it.
Google AdSense
The site is funded by ads served by Google AdSense (Google LLC; Google Ireland Limited for users in the EEA and Switzerland, per Google's controller terms at https://business.safety.google/adscontrollerterms/). Once a page has loaded, the site adds Google's adsbygoogle.js script on every page except the 404 page (publisher ID ca-pub-8029805855741991, listed in ads.txt). There are no ad slots in the site's own code, so any ad you see is placed by Google's script. The script loads and contacts Google whether or not an ad is actually shown.
What Google receives on every page load: the page URL, your IP address, browser and device characteristics (user-agent client hints such as operating system, CPU architecture and browser version; screen size, colour depth and pixel ratio; time-zone offset; browser history length; whether cookies are enabled), a per-page-view session identifier, and any Google advertising cookies already in your browser. On a page load I observed, the script also contacted googleads.g.doubleclick.net, adtrafficquality.google and www.google.com for ad requests and invalid-traffic detection. Google's own description of what it receives from partner sites is at https://policies.google.com/technologies/partner-sites.
Cookies and personalised ads. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads based on your visit to this site and/or other sites on the Internet. Google may also use web beacons or IP addresses to collect information as a result of ad serving. Google acts as an independent controller for this data. Google's list of ad technology partners that may receive data through AdSense is at https://support.google.com/adsense/answer/9012903.
Your controls:
- Opt out of personalised ads: https://adssettings.google.com or https://myadcenter.google.com
- Industry opt-outs: https://www.aboutads.info/choices (US), https://www.youronlinechoices.eu (EU), https://optout.networkadvertising.org
- Blocking third-party cookies in your browser stops the doubleclick.net and google.com cookies only; Google still receives the page, IP and device data on each ad request and can still set first-party cookies such as __gads on this domain. A content blocker that blocks googlesyndication.com and doubleclick.net stops all of it. The incognito check works exactly the same either way.
If you are in the EEA, UK or Switzerland, stated plainly: this site does not currently run a consent banner or consent management platform, so it does not ask for your consent to advertising cookies. Google's policy for requests from those regions that carry no consent string is to attempt only "limited ads", which do not use personal data for personalisation; your IP address is still used to deliver the ad and, depending on account settings, Google may use cookies or local storage solely for invalid-traffic detection (https://support.google.com/adsense/answer/14210870). I am not claiming that no Google cookies are set for you; I am stating what Google says it does in the absence of consent. If you want to be certain, use the blocking options above.
If you are in the US: Google states it receives Global Privacy Control signals directly and switches to restricted data processing (non-personalised ads) for ad requests from states whose laws require it (https://support.google.com/adsense/answer/14182916).
Cookies summary
| Cookie | Set by | Domain | Purpose | Lifetime |
|---|---|---|---|---|
| (none) | detectincognito.com | — | The site sets no cookies of its own | — |
| __cf_bm | Cloudflare (via DigitalOcean hosting) | detectincognito.com | Bot detection; contents readable only by Cloudflare | 30 minutes of inactivity |
| (none) | Ahrefs | — | Cookieless; sets nothing | — |
| __gads, __gpi, __gpi_optout | Google AdSense | detectincognito.com | Advertising, security | 13 months |
| __eoi | Google AdSense | detectincognito.com | Security | 6 months |
| IDE | doubleclick.net | Advertising | 13 months (EEA/UK), 24 months elsewhere | |
| test_cookie | doubleclick.net | Checks whether cookies are enabled | 15 minutes | |
| DSID | doubleclick.net | Advertising, security | 2 weeks | |
| NID | google.com | Ad preferences | 6 months |
The site's rows are verified in its code and build; the Ahrefs row in the script and a live request; the Cloudflare row was observed on every response. The Google rows are what Google documents for AdSense partner sites (https://business.safety.google/adscookies/ and https://policies.google.com/technologies/cookies). Which of them actually get set depends on Google, your region and your settings; in a test from the US where no ad filled, none were set on this domain. sessionStorage entries (scroll position) and the temporary databases the incognito check creates and deletes are not cookies and identify no one.
Legal bases (GDPR / UK GDPR)
| Activity | Basis |
|---|---|
| Serving the pages; hosting and CDN security | Legitimate interest (Art. 6(1)(f)): keeping a free tool available and secure |
| Ahrefs analytics | Legitimate interest (Art. 6(1)(f)): aggregate measurement of a free tool, with no cookies or persistent identifier |
| Google AdSense | Where consent is required for advertising cookies and personalised ads, I have not asked for it, so for visitors in the EEA, UK and Switzerland Google's own policy limits what it serves (see above). Where no consent is required, the basis is legitimate interest (Art. 6(1)(f)) in funding the site through advertising. Google's processing for its own purposes is under Google's responsibility as an independent controller |
| The incognito check | No personal data is processed; the temporary storage it uses is strictly necessary to provide the check you requested |
You can object to processing based on legitimate interest (see "Your rights"). In practice the objection is exercised by blocking the relevant script, because I hold no record that could identify you. Providing personal data is never required to use this site, and blocking analytics or ads has no effect on the incognito check.
International transfers
I am in the United States, so data described above is processed there and, via Cloudflare's CDN, wherever the edge nearest you is. Safeguards as stated by each company:
- DigitalOcean states it is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. DPF, with standard contractual clauses as fallback (DigitalOcean DPA).
- Cloudflare states it relies on the EU-U.S. and Swiss-U.S. DPF, with standard contractual clauses as fallback (Cloudflare privacy policy).
- Google describes its ad-data transfer safeguards at https://business.safety.google/adsdatatransfers/.
- Ahrefs states it stores data in the United States; its data processing addendum incorporates standard contractual clauses (Ahrefs DPA), and it states that its sub-processors include AWS, Google Cloud, Microsoft Azure, DigitalOcean, OVHcloud and Cloudflare (Ahrefs sub-processors).
Retention
I hold no data about you, so there is nothing for me to retain or delete. Third-party retention: Cloudflare's __cf_bm cookie expires after 30 minutes of inactivity; Google's cookie lifetimes are in the table above and its log retention rules are at https://policies.google.com/technologies/retention; Ahrefs states it never stores raw IP addresses and deletes its hashing salt every 24 hours, but publishes no retention period for aggregated analytics; DigitalOcean and Cloudflare publish no retention period for request logs on static sites, and I have no access to them.
Do Not Track and Global Privacy Control
This site's own code does not read Do Not Track or Global Privacy Control signals, because it has no tracking of its own to switch off. The Ahrefs script ignores both. Google states it honours GPC for ad requests from US states whose laws require it. The reliable way to stop either third party is a content blocker or your browser's cookie settings. I do not claim that this site honors DNT or GPC.
Your rights
Because this site stores nothing about you, there is nothing I can look up, correct, export or delete for you, and I will answer any request on that basis. You still have the following rights, which you exercise against the party that actually holds data:
- EU / EEA and UK (GDPR / UK GDPR): access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You may complain to your national supervisory authority (EU list: EDPB members; UK: https://ico.org.uk/).
- Brazil (LGPD, art. 18): confirmation, access, correction, anonymisation, deletion, portability, information about sharing, and revocation of consent. Legal bases are legitimate interest (art. 7 IX) for hosting and analytics and consent (art. 7 I) for personalised advertising where required. No data protection officer ("encarregado") is appointed under ANPD Resolution 2/2022's small-agent exemption; the contact channels below serve that role. Complaints: https://www.gov.br/anpd/.
- California (CalOPPA): the categories of information third parties collect here are described above (IP address, device and browser data, advertising cookie identifiers); Google may collect information about your online activities over time and across sites for personalised ads, which you can turn off at https://adssettings.google.com; I hold no personal information for you to review or change; Do Not Track handling is described above. To my knowledge this site does not meet the CCPA's "business" thresholds, so no "Do Not Sell or Share" link is required; Google's GPC handling still applies to ad requests.
- Canada (PIPEDA, Quebec Law 25): Joe Rutkowski is the person accountable for personal-information handling. Advertising personalisation relies on opt-out consent; the opt-out links are in the AdSense section. Complaints: https://www.priv.gc.ca/.
For advertising data, the effective controls are Google's: https://myadcenter.google.com, https://adssettings.google.com and the industry opt-outs listed above.
To make a request, email [email protected], open an issue at https://github.com/Joe12387/detectIncognito/issues (note that GitHub issues are public), or reach me through https://joe12387.com/.
The site makes no automated decisions about you with legal or similarly significant effects; Google's ad selection is governed by Google's policy at https://policies.google.com/technologies/partner-sites.
Children
This is a general-audience site about browser privacy. It is not directed at children under 13 (or the higher age some countries set), and it knowingly collects no data from anyone of any age. No age verification is performed.
Links to other sites
Pages link to GitHub, npm, opensource.org and https://joe12387.com/. These links are plain hyperlinks: nothing is loaded from those sites until you click, and the links use rel="noreferrer" so the page you came from is not sent to them. Once you leave, their privacy policies apply, not this one.
Changes to this policy
When something changes, I update this page and the effective date at the top. If a new third party ever starts receiving data from this site, or I ever start collecting anything myself, it will be added here before it happens.
Contact
- Email: [email protected]
- GitHub issues (public): https://github.com/Joe12387/detectIncognito/issues
- Personal site: https://joe12387.com/