What label.js sends

For your privacy policy: what label.js sends, and what it never does.

What it sends

If you add label.js to your site, it runs in your visitors' browsers and talks to cdn.disclarion.com. For each element you mark with data-disclarion, it sends:

the page address: origin and path only, never the query string or fragment;
for text: a fingerprint computed in the visitor's browser, never the text itself;
for images: every address the image can show, from its src and srcset and from the <source> elements of its <picture>, with any query string, plus which one the browser displayed (current_src). Our server downloads the displayed image to fingerprint it, then discards the image. It stores the displayed address as origin and path only, and the other addresses only as one-way hashes;
the AI provider and model you set in data-disclarion-provider / data-disclarion-model, if any;
your site code and the label.js version.

label.js asks cdn.disclarion.com once per page view whether Disclarion Connect manages labels on your site. It sends your site code and the page address, origin and path only: label.js removes the query string and the fragment in the visitor's browser, so they are never sent. On a site that uses Connect it may also send, at most once per page view, the addresses of images Disclarion doesn't know yet (with their query strings, as for marked images) and a note that the page's text has changed. It never sends the text itself or image pixels.

label.js sets no cookies, uses no localStorage, sessionStorage or IndexedDB, and reads nothing about the visitor. The visitor's IP address reaches our server with the request, as with any web request; we use it only in memory to rate-limit requests and our application never stores or logs it (our hosting provider, Railway, keeps its own standard request logs). What we store is metadata only: hostname, page address, fingerprints, image address, provider and model, timestamps and check results. Never the text, never the image, never visitor data. We process this on your behalf under our Data Processing Agreement. See also our privacy policy and sub-processors. The public verify page for a label shows its hostname and page address.

Check your image addresses: if they carry a token, a signature or a user identifier (for example signed CDN URLs or per-user image links), label.js sends those addresses, query string included, to Disclarion.

A line you can adapt for your own privacy policy:

"Our pages use label.js from Disclarion (cdn.disclarion.com) to mark AI-generated content. When a page loads, it sends Disclarion the page address (without its query string or fragment), fingerprints of the marked text, the addresses of the marked images and, on sites that use Disclarion Connect, the addresses of other images on the page that Disclarion has not seen before. Your IP address is used only briefly to prevent abuse; Disclarion does not store it beyond its hosting provider's standard request logs. It sets no cookies and stores nothing in your browser."