Privacy

What Ask the Tarmac records when you use it, and for how long. It answers questions about public US airline on-time data, and it doesn't need to know who you are to do that.

Your questions

• The text of a question is not stored. For each question the server records when it was asked, which access token asked it, how many characters it had, the query plan it became (the measure, breakdowns, filters and dates), which tables were read, how many rows came back, which model answered, how many tokens it used, how long it took and whether it was answered or refused. These records are kept for 90 days, then deleted automatically.
• To answer, the question's text is sent, after the engine's redaction step, to the language model that plans and words the answer (Anthropic's Claude).
• A repeated question can be answered from a cache. The cache stores the answer under a one-way SHA-256 key made from the question, not the question itself. Once the data is refreshed, older entries are never used again and are deleted at the next cache write.

The email you give at sign-in

• Giving an email when you sign in is optional, and it isn't checked. If you give one, it is stored as is, not hashed, with every sign-in and sign-out, each report you save, each report you run or read where no model is called, and your session record. Without one, those records carry the access token's name instead. The sign-in, report-run and report-read records are kept for 90 days, then deleted automatically. A saved report keeps it until the report is deleted.
• A question you ask, a report the model writes up, and each of their model calls in the spending ledger below never carry the email you gave: they carry the access token's name with the keyed name of your address described below, whether or not you gave an email. Only the site's operator's carry the email.
• If you pick how to read a phrase like "last period", the choice is saved under the access token and your email so you aren't asked again. Nothing is saved without an email, and because a question doesn't carry the email you gave, only the site's operator's choices are kept. A choice is kept until you undo it or an administrator clears it.

Sign-ins and your IP address

• Each sign-in, failed sign-in and sign-out, and each time a token is slowed down for asking too fast, is recorded with the time, the access token and your IP address as the server sees it. The address is stored as is. It is not hashed. These records are kept for 90 days, then deleted automatically.
• While you're signed in, the session record holds your IP address, the email you gave and your browser's user-agent string. A session lasts 12 hours, or 30 days if you chose to stay signed in. The record is kept until a week after that time is up, even if you sign out sooner, and is deleted at the next cleanup after that.
• When the site is open to visitors, your first visit signs you in as a visitor with no token, and that sign-in is recorded and its session kept exactly as above, as a 30-day session. The visitor sessions one address, the block it belongs to and the whole site may open in an hour are counted in memory.
• Requests and failed sign-ins from one address are also counted in memory, to slow down floods and guessing. Those counts are never written to disk and reset when the server restarts.
• To share the day's question budget fairly, a question or a report run is labelled with a keyed name of your network address: a one-way code (HMAC-SHA256 under a secret only the site holds) for your address and another for the block it belongs to (for IPv6, the /64 and the /48 around it). The address itself is not stored with it. With the secret the name can be traced back, because an address can be found by trying each one, so treat it as the address. The label goes with that question's record and its report-run or report-read record, kept for 90 days, then deleted automatically, and with each of its model calls in the spending ledger below, kept without a time limit. It is recorded whether or not you gave an email at sign-in, and left out only for the site's operator.
• How many questions each address and each browser or access token asked on a day is counted in the database under the same kind of keyed code, never the address, token or cookie itself. A day's counts are deleted once they are a week old, at the next question after that.
• How busy the site is gets counted by the hour, for the administrator's page: how many requests each part of the site took, with what kind of reply, how long they took (in ranges), which limit refused one, and how many different browsers came that hour. A count carries no address, token, cookie, page address or search text. These counts are deleted after 30 days.

Cookies

One cookie keeps you signed in. A second one, att_caller, holds a random number and its signature so the question limits can tell one browser from another. It names nobody, is sent only to this site and lasts a year. When you come in as a visitor, your questions and saved reports are filed under a keyed code made from that number (HMAC-SHA256), never the number itself. There are no advertising or analytics cookies, and nothing on the site loads from another company's servers.

Server logs and hosting

The site runs on Railway. The server's request log records each request's method, path, IP address and timing, but never a question's text, which travels in the request body. Railway keeps those logs for its plan's log-retention period.

Spending records

A ledger of model calls (which model, how many tokens, how long, whether it worked, and who asked: the access token's name with the keyed name of your address described above; for the site's operator, the email they gave or the token's name) is kept without a time limit so the site's spending can be checked. It holds no question text and no IP address in the clear.