{
  "analytics": {
    "enabled": true,
    "fields": [
      {
        "field": "IP address",
        "meaning": "the address the request came from"
      },
      {
        "field": "Host",
        "meaning": "which of this server's sites was asked"
      },
      {
        "field": "Path and method",
        "meaning": "the URL requested and how"
      },
      {
        "field": "Status",
        "meaning": "what the server answered"
      },
      {
        "field": "User agent",
        "meaning": "the browser or client string your software sent"
      },
      {
        "field": "Referrer",
        "meaning": "the page that linked you here, if your browser sent one"
      },
      {
        "field": "Timestamp",
        "meaning": "when"
      }
    ],
    "max_rows": 20000,
    "respects_dnt": true,
    "retention_days": 14,
    "visitor_cookie": false,
    "visitor_cookie_days": 0
  },
  "controller": {
    "contact_email": "dan@q9.is",
    "jurisdiction": "United States",
    "missing_settings": [],
    "name": "DBBASIC",
    "signed": true
  },
  "cookies": [
    {
      "first_party": true,
      "http_only": true,
      "max_age_days": 1.0,
      "max_age_seconds": 86400,
      "name": "dbbasic_session",
      "necessary_because": "you asked to sign in, and there is no way to stay signed in without it",
      "purpose": "Keeps you signed in after you enter your password.",
      "same_site": "Lax",
      "set_when": "You sign in.",
      "strictly_necessary": true
    },
    {
      "first_party": true,
      "http_only": true,
      "max_age_days": 14.0,
      "max_age_seconds": 1209600,
      "name": "cart",
      "necessary_because": "you asked for a basket; a shop cannot keep one without a way to recognise it",
      "purpose": "Remembers which basket is yours, so what you put in it is still there on the next page. It holds an opaque token, not the contents.",
      "same_site": "Lax",
      "set_when": "You put something in the basket.",
      "strictly_necessary": true
    }
  ],
  "extra_markdown": "",
  "installed_packages": [
    "app-invoices",
    "app-orders",
    "app-payments",
    "app-shipping",
    "app-shop"
  ],
  "processing": [
    {
      "id": "traffic",
      "kept": "14 days",
      "shared_with": [],
      "title": "Traffic to this site",
      "why": "To see how many people visit, which pages they read, and to spot attacks and broken links."
    },
    {
      "id": "orders",
      "kept": "for as long as the law requires business records to be kept, which is longer than you might expect",
      "shared_with": [],
      "title": "Orders and invoices",
      "why": "To take, fulfil and account for what you bought. These are business records."
    },
    {
      "id": "payments",
      "kept": "with the invoice it pays",
      "note": "No payment provider is configured on this server; payments are recorded by hand.",
      "shared_with": [],
      "title": "Payments",
      "why": "To take payment and to reconcile it against your invoice."
    },
    {
      "id": "fulfilment",
      "kept": "with the order it belongs to",
      "note": "No carrier account is connected to this server, so no address is sent to one from here.",
      "shared_with": [],
      "title": "Delivery",
      "why": "To get the parcel to the address you gave."
    },
    {
      "id": "ai",
      "kept": "the request is not stored by this server beyond its usage record (which service, how many tokens, when)",
      "note": "AI features are only reachable by a signed-in operator of this server, not by visitors.",
      "shared_with": [
        "anthropic",
        "openai"
      ],
      "title": "AI features",
      "why": "Text you type into an AI feature on this server is sent to the provider below to answer it."
    }
  ],
  "rights": {
    "contact_email": "dan@q9.is",
    "correction": "Ask, and a wrong name, address or email will be corrected.",
    "erasure": "Ask. Orders, invoices and payments are business records with a statutory retention period and usually cannot be deleted; contact details that are not part of such a record can be.",
    "export": "Ask, and everything this server holds against your email address can be exported and sent to you.",
    "traffic": "Traffic records are keyed to an address and a token with no link to a person, so they cannot be searched for you in either direction; they age out on the retention above."
  },
  "subprocessors": [
    {
      "because": "an API key for anthropic is stored on this server",
      "data": "the text an operator of this server types into an AI feature, and whatever server records that feature reads to answer it",
      "name": "anthropic",
      "role": "AI features"
    },
    {
      "because": "an API key for openai is stored on this server",
      "data": "the text an operator of this server types into an AI feature, and whatever server records that feature reads to answer it",
      "name": "openai",
      "role": "AI features"
    }
  ]
}