TECHNICAL DOCUMENT

How We Watch Site Visits

An honest note for parents. We told you “all your data stays on the phone — we don’t upload anything to the cloud” — that’s about the Tortoise Time app. But what about this website? Do we look at visits? How? This piece spells it out.

Short Answer: Yes — but only from our own server logs

We use an open-source tool called GoAccess. How it works: it reads the nginx access logs that our own server records — the same kind of log any web server records when anyone visits any site. We don’t put anything inside the web page.

Specifically:

We don’t set cookies — there’s no “Tortoise Time website” cookie in your browser
We don’t inject tracking JavaScript — open your devtools Network tab, you won’t see any requests sending analytics
We don’t use Google Analytics / Cloudflare Analytics / etc. — your browsing doesn’t leave our server, much less go to a third party
No third-party SDKs — the whole site is static HTML/CSS/images and nothing else

What We Can See

The basics that any server can see (this is unavoidable in how the web works):

How many people visited today (counted by unique IPs)
Which pages they viewed (/, /story, /docs/public/16, etc.)
Rough origin (country, browser)
Whether pages loaded successfully (200 OK or 404 NotFound)
Referrer if any (where the link was clicked — but if you opened from WeChat, WeChat strips this, so we don’t know)

What We Can’t See

Your name, email, phone, device ID — these aren’t transmitted by basic web access at all
Mouse movements, time-on-page, click heatmaps — these require tracking JS which we don’t include
Your browsing history on other sites — that’s the kind of cross-site tracking Google Analytics does, we don’t have it
Whether two visits are the same person — without cookies, we can’t tell. Each visit is just an IP, and the same person on a different wifi becomes two visits

Why We Do It This Way

Because in our app we tell parents “all data stays on the phone.” If we then loaded the homepage with Google Analytics, Baidu Stats, heatmaps, and user behavior tracking — you’d open our site to learn about us, and the first thing that happens is your data gets uploaded to Google and Baidu. That contradicts what we’re telling you.

We don’t want that. GoAccess is free, open-source, runs entirely on our own server, and just takes the logs nginx is already keeping and turns them into charts for us. It doesn’t reach out to your browser, and it doesn’t send anything to any third party.

You Can Verify

You can.

Open browser DevTools → Network tab → reload https://serpilo.com — you’ll only see requests to our own domain (HTML, CSS, images). You will not see requests to google-analytics.com / static.cloudflareinsights.com / hm.baidu.com / etc.
Open DevTools → Application → Cookies → https://serpilo.com — it should be empty.

If we ever change our mind and add a third-party analytics tool, we’ll say so clearly in the footer or in this document. We won’t sneak it in.

What We Use the Data For

Mostly:

Which pages parents and kids actually read — helps us pick what to write next
Which pages 404 — helps us fix dead links
Which countries have more readers — helps us decide what to translate first
Just how many people care today — a basic pulse check

We don’t use it for:

Selling to anyone
“Personalizing” pages (every visitor sees the same content)
Connecting to ad networks (we don’t have ads)
Connecting to user-profile systems

One Sentence for Parents

If you’ve read this and still aren’t fully comfortable, the simplest thing is to open https://serpilo.com in your browser’s incognito mode. The only difference is your browser cleans itself when you close it — what we see on our end is the same independent IP either way, no more, no less.

Want our broader privacy commitment to parents → App Permissions Explained Want to see how the child’s screen time data is handled → Gentle Guidance