Security and logging

What the access log keeps

TrickyBird has no account and keeps a small access log for at most 48 hours. The log writes one line for every request the proxy makes on your behalf, so it holds the hostname of each site or service a page loads from, not only the address you typed, together with a shortened form of your IP address and basic response details. The access log never holds the specific pages you open on those hosts, page contents, or messages. A page pulls images, video, scripts, and fonts from other hosts, and each of those fetches is its own line with its own hostname. The shortened IP is the first 3 blocks of an IPv4 address or the first 3 groups of an IPv6 one, so it points at a neighborhood rather than a single address. We keep the log to run the service and to stop abuse. We do not sell the access log and we do not share it with advertisers. Outside that log, when a session starts, the service counts requests against your full IP address, so it can stop bulk automated abuse. That count carries no destination and no session, and it expires on its own.

What the access log never records

A log line is a fixed set of fields. There is no field for any of these:

• The specific pages and paths you open, or the terms you search for
• The content of the pages you load, or anything you type into them
• Your full IP address
• Your session token, or any cookie from the sites you open
• The browser and the device you are using
• Any name, email, or account, because TrickyBird never asks for one

How a session works

There is no server-side session record. Your session is a signed token that the proxy checks by its signature alone, and it expires within about an hour. The token is carried in a cookie that the pages you open cannot read. Nothing renews it. When it expires, the tab returns you to the console and you open the site again. You cannot cancel a session early. Closing the tab does not end it sooner, and clearing the cookie only stops your own browser from sending it.

Some short-lived state on our servers is tied to your session while it lasts. TrickyBird holds the cookies the sites you open have set, in a server-side store keyed to your session and that site’s hostname. Each entry lives about an hour from the last time it changed. It also holds the address the session started on, in memory only. The counters that limit abuse are tied to your session as well. All of that state expires on its own.

Cookies from the sites you open

The proxy captures the cookies that the sites you open set, keeps them in that server-side store, and attaches them again each time it fetches on your behalf. Before the response reaches your browser, TrickyBird removes the site’s instruction to set a cookie.

One exception keeps pages working. Many sites need their own scripts to read those cookies back, so a copy of those values goes into your browser’s cookie store, under TrickyBird’s own address. Your browser never files it under the site’s own domain. When a page sets a cookie of its own, the code TrickyBird adds to that page sends it back to the server-side store, so the store stays in step. Clearing your browsing data removes the browser copy. TrickyBird does not remove it for you when a session ends.

The connection between you and TrickyBird

The connection between your browser and TrickyBird is encrypted, both on this site and on the address a session runs on. TrickyBird then makes its own separate connection onward to the site, and the encryption between you and TrickyBird does not reach that one. Those are 2 separate connections that meet at TrickyBird. TrickyBird receives and rewrites each page, so it handles the content of the pages you open.

Zero domain leakage

The address of the site you open never appears in your URL bar or on the page you see. Your browser loads the page and the content on it through TrickyBird’s own address rather than from the site directly. TrickyBird connects to the site for you, so it does reach the site and records its hostname in the access log. Your own network can see that you connected to TrickyBird. What your network does not see is which site you opened. Check it yourself: the site’s own name is nowhere in your URL bar.

What we do not claim

• We are not an anonymity tool. TrickyBird hides your IP address from the sites you open. Your own network can still see that you are using TrickyBird, and TrickyBird is not built to stand up to a determined adversary.
• We handle the content of your pages. TrickyBird has to decrypt each page, rewrite the addresses inside it, and encrypt it again to serve it from its own address. Page content passes through our servers in readable form. The encryption between you and TrickyBird does not extend past TrickyBird to the site.
• TrickyBird is not an ad blocker and it is not a safety filter. It does not block ads, trackers, or anything else a page chooses to load.
• Every site you open through TrickyBird is served from the same TrickyBird address, so the separation your browser normally keeps between 2 different sites does not apply here. Treat one session as one space, and do not open an account you care about alongside a site you do not trust.
• TrickyBird does not handle WebRTC. If a page uses it, that traffic runs outside the proxy and can give the page your real IP address.
• A session cannot be canceled early. It stops working when it expires, and closing the tab or clearing the cookie does not end it any sooner.
• The access log is a real record. For as long as it is kept, it shows a shortened form of your IP address next to the hostnames your session reached, including the hostnames of the other services each page loaded from.
• The address you typed stays in your own browser. The link that starts a session carries it, so it lands in your browser history and in anything you copy or share from that tab. That part is on your device, not on our servers.
• If you open an address that starts with http rather than https, the connection between TrickyBird and that site is not encrypted.

Where to check the rest

Run the check yourself on a site you pick, and look for its name in the URL bar and the page source. The privacy policy covers the rest: mail, legal requests, and what a shared browser session means. TrickyBird next to a VPN explains where a web proxy is the wrong tool.