Privacy

What is recorded

Which tabs and sections you open and how long you spend on them, which figures come into view, clicks on figures and buttons (where on the figure and on the page you clicked), slider and switch movements, scroll depth, steps in step-by-step mode, theme changes, quick quiz answers (only “right” or “wrong”), the fact that you sent a message to the developer (without its text) and page errors.

About the device: browser, operating system, type (computer, phone or tablet), screen size, language, time zone, theme, the site you came from (not the specific page) and the utm tags from the link. Also which version of the atlas you’re reading: Ukrainian or English.

What isn’t recorded

• Cookies — the statistics don’t use them.
• IP addresses — they aren’t in the database or in the server logs.
• The full browser string (user agent) — only the browser, system and device type.
• The text you type: the search box sends only the query itself (up to 40 characters), and the “Cut up your own text” box sends only its length.

How to turn it off

If your browser sends a Do Not Track or Global Privacy Control signal, no statistics are collected at all.

How visitors are counted

Every day the server creates a new random number (a “salt”) that lives only in its memory and is never written anywhere. A visitor’s identifier is a fingerprint computed from the salt, the IP address and the browser. The next day the same visitor gets a different identifier, so the statistics can’t be linked to you or across different days.

Tagged links

If the atlas is opened from a link with a ?k= tag in the address (for example, from a newsletter or a post), the sessions are labeled with that name — this shows how many visits the link brought. Without such a tag, a session has no label.

Browser storage

The tab stores a random session number; it is sent with the statistics and disappears when you close the tab. While the tab is open, it also keeps the exam state — the number of your last attempt, so that its result can be shown after a reload. In addition, the browser remembers your chosen theme, the last example, your best quick quiz score, a first-visit flag, the state of the 3D scene legend (collapsed or expanded) and the language you last picked in the UA | EN switch — these entries stay in the browser and aren’t sent to the server.

You need to sign in only for a ranked exam attempt. The quick quiz and practice work without signing in.

What the site gets from Google

Only your account identifier (the openid permission) — no email, name or photo. The identifier itself isn’t stored: the server immediately computes an HMAC-SHA256 fingerprint of it with a secret key and keeps only the fingerprint. The site uses it to recognize you the next time you sign in, but no one can learn from the database who you are on Google.

What is stored

• The identifier’s fingerprint, your nickname and the date the account was created.
• For each ranked attempt: which questions you got, your answers, the time spent on each answer, the result and the language of the page you started it from.
• The name you enter for your certificate.

Why

For the leaderboard and certificates, for the “one ranked attempt per 24 hours” rule and for fairness checks: attempts with suspiciously fast answers and results of 95% and above don’t appear on the leaderboard until an administrator reviews them.

The sign-in cookie

After you sign in, the site sets one cookie — atlas_exam: signed, not readable by the page’s scripts, valid for 30 days. Signing in doesn’t work without it. Signing out deletes it. Another technical cookie, atlas_oauth, lives for 10 minutes only while you sign in with Google: it protects the sign-in from forgery and remembers which language version to bring you back to.

Google knows that you sign in to LLM Atlas — this is governed by Google’s policies.

At the bottom of every atlas page there is a “Write to the developer” button: use it to send feedback, a question or a bug report.

What is stored

• The text of the message.
• A contact, if you gave one (email, Telegram or anything else) — the field is optional.
• The page section you sent it from (for example, #compare), the page language and the time.
• Browser, system and device type — without the full browser string (user agent).

What isn’t stored

IP addresses and cookies. To keep the form free of spam, the server counts how many messages come from one address and one network per hour and per day. For this it keeps fingerprints of the address and the network, made with the daily salt (as in the statistics), in memory and never writes them anywhere.

Who sees them and how long they’re kept

Only the site’s administrator sees the messages. They are kept for 365 days and then deleted automatically.

• Leaderboard — nickname, percentage of correct answers, time and date. Every visitor to the site can see it.
• Certificate — the name on the certificate, the result and the date, on the page /en/cert/<number> (in Ukrainian, /cert/<number>). The number is random and can’t be guessed: whoever you give the link to can see the page. Search engines don’t index it.
• The administrator sees nicknames, attempts and results and can hide or change an offensive nickname. They don’t see your Google email or name: the site never receives them.

Sign in, go to Quiz → Exam and press “Delete account”. Your account, nickname, all attempts and the names on your certificates are deleted immediately; your certificate pages will show “Certificate revoked”. If you started a ranked attempt in the last 24 hours, only the fingerprint and the time when you can start the next one remain until those 24 hours are over: this way, deleting your account doesn’t get around the one-attempt-per-day rule. Automatic disk backups at the hosting provider may keep the previous state for a few more days.

Messages to the developer: use the same form to say which message to delete (for example, its date and first words). The administrator will remove it from the list, and it will be gone from the database for good within 30 days.

The statistics can’t be deleted selectively: they are anonymous, and there’s no way to find your visits among them. They are deleted automatically after 365 days.

No one. The data isn’t sold or shared with third parties; the site has no ads and no third-party trackers.

The site uses two external services:

• Fly.io — hosting: the server and the database are in Frankfurt (EU).
• Google — exam sign-in (only if you sign in) and the page fonts: your browser loads them from Google Fonts servers.

The site serves the three.js 3D graphics library itself, without third-party servers. Like any website, Google Fonts receives your browser’s IP address and name; what it does with them is governed by its policies.

Questions about your data, requests to correct or delete something — use the “Write to the developer” form at the bottom of any atlas page. If you’d like a reply, leave a contact in the form.