Privacy

flâneur (flaneur.sdan.io). Last updated 3 November 2026.

flâneur is a public map of reading. Most of what it shows is public: links readers have saved, the readers who saved them, passages readers chose to share, and public pages visitors opened in the reader. This page says plainly what we collect, where it goes, and what we never touch.

The website

Reading and searching

• flâneur has no sign-in. Reading the map, searching and everything else here need no account.
• Search. What you type, or a passage you select in the reader to search with, goes to our server, which turns it into an embedding with Cloudflare Workers AI to find matching pages. An embedding is a list of numbers, not the words. We keep it at Cloudflare for up to 30 days under a one-way hash of the words, with nothing about who asked, so the same search by anyone skips that step. The hash cannot be turned back into the words, though someone who guessed them could check the guess. flâneur's database does not keep your words. Results for a search are cached at Cloudflare for five minutes, with nothing about who asked. The names on the map are searched ahead of time, every hour, and their results kept for up to two hours. A search on the search page or the map is sent as part of the request's address. Cloudflare's request log keeps the address of each request for up to 7 days, but since 2 November 2026 it drops everything after the question mark, which is where your words are. The requests flâneur's pages make name only flaneur.sdan.io as where they came from, not the page with your words in it. On the search page your words also land in our analytics, because the results page is titled with your search. A reading path you share keeps the searches in it.
• Smart cards. Some searches show a card drawn from their results. If none fits yours, your question and the public results beside it are sent to a language model that our host, Cloudflare, runs for us (Workers AI), and it writes one. We keep the question, those results and the card, with no IP address attached. A card written for one question may also be shown to other readers whose results are mostly the same: they see the card, written for that question, beside their own question, but not the question itself. A card can be wrong: the parts drawn in ink are quoted word for word from a result, and the rest is the model's own reading.
• The pocket pen. An experimental pen can write a card on your own device. It is off unless you choose it, and your choice is remembered on that device. Once chosen, your browser downloads a small language model (about 194 MB) once: its code from jsDelivr and the model from Hugging Face and GitHub, which see your IP address as with any download. Your question and results are not sent to them. The model runs on your device, and the cards it writes stay in your browser.
• The reader. The reader opens pages flâneur already has. When flâneur has no copy of a page's text, our server fetches the page (the site sees our server, not you), keeps a copy of its text and adds it to search, with no link to you.
• Adding a page. When you add a page, from a search for its address or on Add a page, our server fetches it (the site sees our server, not you), keeps a copy of its text, and adds it to flâneur's search for everyone, with no link to you. When the page is mostly a list of links, such as a site's front page, our server also fetches up to 30 pages it links to on the same site, one a second, leaving out any the site's robots.txt asks robots to skip, and adds them the same way. We note when a page was added, not who added it. Only add public pages you are comfortable making findable.
• Shared reading paths. When you share a reading path, we store the searches in it (each can be up to 60,000 characters) and the pages and passages it followed. Anyone holding the link can open it. It is not tied to you or your IP address. We keep it with no end date, and there is no way to delete one yourself.

Analytics

• Visits are measured by our own analytics service at pingpong.sdan.io, which runs on Cloudflare. It keeps a random visitor ID in your browser's local storage. For each visit it records:
  • What you read: the page path and title (on a results page the title is your search; in the reader, the article's title), how long and how far you read, when you copy (its length, not the text) or print, and how many links deep you go on the map.
  • Where you came from: the site that sent you, as its origin only (like https://example.com), not the full address.
  • Your browser and device: the full user-agent string, language, time zone, platform, screen and window size, CPU cores, memory, connection type and speed, pointer and display settings, and accessibility preferences such as reduced motion and contrast.
  • How the page loaded: load and responsiveness timings, including the addresses of the largest file and the slowest script.
  • Where you are: an approximate location (city, region, country, coordinates) and your network provider's name and number, which Cloudflare derives from your IP address.
• While a page is open, a live connection to pingpong.sdan.io reports which page you are on and when your visit started.
• These analytics records do not include your IP address itself, though Cloudflare's log of requests to the analytics service, kept for up to 7 days, can. A keyed hash of your IP address is stored with each page it viewed, so a view is counted once every five minutes. Do Not Track and Global Privacy Control are recorded but do not stop collection. These records have no set expiry.
• The analytics dashboard is public. It shows which flâneur pages were visited, the site each visit came from, its city and country, and, while a page is open, roughly where its reader is on a live globe. It shows no names or IP addresses.
• Cloudflare, our host, also counts page loads with its Web Analytics. A script from static.cloudflareinsights.com reports the page path (not your search), the page you came from, your browser and load timings. It sets no cookies.

Other services your browser contacts

Like any site you load, these see your IP address and that the request came from flâneur.

• Site icons. The small icons beside results and links come from DuckDuckGo's icon service, or from the site itself when DuckDuckGo has none. They learn which websites' icons were asked for, not your search.
• Fonts. The map pages load the Inter typeface from Google Fonts.
• Error reports. If a request fails, your browser may send Cloudflare a short report about it. The report includes the request's full address, so for a failed search it includes your words.
• The pocket pen. Its one-time download, above.

Imported reading histories

• flâneur imports public reading histories from another bookmarking service. For every imported profile we copy its public profile record (including name, handle, links, school, follower and view counts, the accounts it follows and last-active time) and its new saves from that service every hour. The copy adds saves but never removes them.
• Marks that came with an imported history are public on its profile's Highlights tab.

Accounts made before 2 November 2026

• Until 2 November 2026 you could sign in with Google, link an older reading history to your account, and save pages and mark passages here or with the flâneur browser extension. All of that is gone: nothing here signs you in, saves or marks any more.
• For an account made before then we still hold what we stored: your Google account ID, verified email address, name and sign-in times; hashes of your session and extension tokens, none of which work any more; your reader profile and its link to your account; the pages you saved and removed; the passages you marked, with the text around them, and your notes; your choice about publishing marks; and your linking attempts and verified link. Your profile and the pages it saved stay public, and so do marks you chose to publish. Private marks stay private.
• A copy of the extension still installed keeps asking flaneur.sdan.io about each page you open (its address, without any #section) to draw marked passages in the margin. Remove it to stop that.

Programs and AI assistants

• The same public data is open to programs and AI assistants through our public index and MCP server: links, public reader names and handles, the links they saved, and marks readers chose to share. Our host, Cloudflare, also adds a script to our pages that offers these tools to AI assistants running in your browser. It talks to flaneur.sdan.io, and when an assistant asks, its image tool downloads the images already on the page, such as site icons, to inspect them. Private libraries, private marks and account details are never included.

Logs and limits

• Our host, Cloudflare, keeps a log of each request our server handles, for up to 7 days, for debugging. Each entry has the address requested, without anything after its question mark, and request details such as your browser, and it can include your IP address.
• To prevent abuse, we use your IP address for about a minute at a time to limit how often sharing reading paths, smart cards, adding pages and the MCP server can be used, and to slow bursts of page loads from one browser signature that scrapers use. The limits keep no record of it.

In your browser

• The website keeps a few things in your browser: the analytics visitor ID, your theme setting, what you have already seen this session, and, if you use the pocket pen, your choice, the last 40 cards it wrote and the downloaded model. Clearing this site's data removes them.

What we never do

• Sell personal data. Beyond the public parts described above, it goes only to the services named on this page, each of which runs part of flâneur.
• Use data for advertising, credit, lending, or tracking across sites.
• Use an advertising service, or any analytics beyond our own and Cloudflare's page-load counts.

Deleting your data

To delete an account made before 2 November 2026, message corporate@sdan.cc. It is done by hand, within a week, and covers your sign-in record, sessions, extension tokens and sign-in codes, reader profile, saves, removals, marks, notes, publishing choice, and your linking attempts and verified link.

If your account is linked to an imported reading history, we remove the link and what you added on flâneur, but the hourly copy brings that imported public profile and its recent saves back from the other service for as long as that service lists it.

Searches, smart-card questions, pages opened in the reader and shared reading paths are not tied to an account, so they cannot be found or deleted by account. A search's kept embedding expires within 30 days. Analytics visits are filed under your browser's visitor ID; clearing this site's data starts a new one. Request logs expire within 7 days.

Questions: message corporate@sdan.cc.