--- title: "What the App Stores and Sends | Knock, knock, AI!" description: "Where the app keeps its data on your server, what goes out to api.adinspire.com, and what never leaves your logs." url: "https://knockknock-ai.app/docs/privacy-and-data/" lang: "en" published: 2026-11-08T00:00:00+01:00 updated: 2026-11-13T00:00:00+01:00 --- # What the App Stores and Sends Everything the app collects goes into plain files in a data folder on your server. There is no database. This page describes the app. The privacy policy of this website is a separate page, at [Privacy policy](https://knockknock-ai.app/privacy-policy/). ## The data folder The folder is named `data-` plus 24 random hex characters and lies in the app folder. The app creates it at the first visit of the address and closes it to the internet. On a server that ignores `.htaccess` (nginx) only the random name protects it. There must be exactly one such folder. Two or more are a configuration error. ## What lives in it - Copies of your server logs with IP addresses, when the app copies or downloads them, which is why the folder must stay closed. With direct reading the app reads the log where it lies and the folder for copies stays empty. - The log files you upload by hand (the way "I upload files"), under names the app makes itself. A file that was read to the end is deleted after 14 days, and the visits from it are already stored. Nothing from these files goes to `api.adinspire.com`. - The encrypted password of your FTP or SFTP account, the SFTP private key and the encryption key, only when you save a password or a key. The permissions of these files are 0600. - The stored bot visits, one file per day (the day in UTC). - The arrivals of people from AI answers (the beta feature Traffic from AI), one file per day (UTC), with no IP address and no User-Agent. - The settings of the installation and the sessions of logged-in users. - Copies of the IP lists of bot providers, downloaded at most once a day. - The list of page addresses from your sitemap and the type of each page, downloaded at most once a day. - A trace of response sizes for your sitemap pages: for every page and every size of a 200 answer, the first and last time and the number of answers per day. It counts the answers to all visitors, humans included, because more answers give more exact versions. It holds no IP addresses and no User-Agents. - The visible text of your sitemap pages, read from the files of your site, only when the app knows the folder with the page files. - The panel data, built after a run that stored new visits. The folder can be deleted, and the next run writes it again. - The visit history in `panel/history.json`: the visits of each day, the total, the first and the last day, the days whose file is damaged. When a day has fewer visits than before or has gone (except the days older than 13 months, which the app deletes by itself), the file records the drop for 14 days and the status page warns about it. No IP addresses and no User-Agents. - The diagnostic log in the folder `diag/`: one line per event (a run, the building of the panel, a drop of the visits, a change of the settings) with the time and the version of the app. Only numbers, names of domains and days. No IP addresses, User-Agents, referers, passwords or login data. It grows to 2 MB, then the app starts a new file and keeps the previous one, about 4 MB in all at most. The owner downloads it from the status page for support. - The list of addresses outside the sitemap in `panel/outside.json.gz` (and `panel/outside/.json.gz` for the other domains): for every address the visits and the answers with an error per day and bot, and the time of the last visit of each bot. At most 3000 addresses; the address has no parameters after `?`. No IP addresses and no User-Agents. - The results of the Access and Common Crawl checks. - The files of the updates, in the folder `update/`: the last check for a new version, the downloaded newer list of bots, and during an installation the copy of the previous version, the record of the job and the package being switched in. No IP addresses and no User-Agents. - The state of the last run: times, counts of files and rows, the log format. No log lines and no IP addresses. ## A stored visit A stored bot visit holds, among other things, the IP address, the User-Agent and the referer. The full list of fields: the time from the log, the bot with its company and role, the User-Agent, the IP address, the verdict, the request (method, path with the part after `?`, status code, size), the referer and, for one log format, the country and the continent. People and other visitors are never stored as bot visits. The one exception is the arrival of a person from an AI answer, described below. Rows of domains that are not collected are only counted. ## Arrivals from AI (beta) The beta feature Traffic from AI stores the arrivals of people from AI answers: the time, the page address without parameters, the platform and the trace that matched (`utm_source` or the referer). It stores no IP address and no User-Agent. It collects from the day of installation and, once after installation, reads again the logs that are still on the server (usually 7 days). ## How long it is kept The app keeps stored bot visits for 13 months. Once a day, when it recalculates, it deletes the day files older than 13 calendar months by itself, also in the folders of the other domains. The day files of arrivals from AI older than 13 months are deleted together with the visits. ## What the panel does not have The visit files hold the IP address and the User-Agent of every visit. The panel data holds none of these fields. The app checks it at every write, so the panel shows numbers and page addresses and never who came from which address. ## What goes out Only these items go to `api.adinspire.com`: the home page address and up to 19 other addresses (the Common Crawl check, 20 in total), the panel language and the installation identifier. The check for a new version is the exception, with its own rule. It sends the version number of the app, the random installation identifier (the same as in the Access check) and the domain of your site (the domain only, without `www`, path or port). The version and the identifier always go. The domain goes only while the switch "Send the site address" on the Updates screen is on, and it is on by default. After you switch it off, the next check sends no domain. The app checks once a day and after a click on "Check now", only on a public address, so a local or test copy asks nobody anything. The download of the package and of the list of bots carries neither the identifier nor the domain. Nothing from your logs goes out. No visitor IPs and no User-Agents. Only the Access view, the Common Crawl check and the updates use that service. ## What the app downloads The app downloads these things from the internet: the IP lists of bot providers, the sitemap of your site (and the WordPress categories) and its own test file from the data folder. From `api.adinspire.com` it also downloads the information about new releases, a newer list of bots and, after you click "Install", the package of the app. The package is checked by its digital signature. If you choose SFTP or FTP, the app also downloads the log files from your own hosting account. ## Other domains in the same log With the field "Also collect other domains" switched on, the app collects the visits of all domains from one log. Every other domain with a bot visit gets its own folder with the same layout of files. The app keeps at most 200 other domains in one run. A visit to a further domain is not stored, and the status page says how many rows were skipped. How we verify bots Read the install guide