Service fact sheet
This page is for an agency's counsel. It lists the services the project runs for its hosted web application (psi.data-bridge.org, staging.data-bridge.org and demo.data-bridge.org) and states, for each, what it receives, what it stores, how long it keeps it, where it runs, and who operates it. It states facts only and makes no determination under any law or regulation. Each fact links the section that states it in full, and the check that keeps it true where one exists.
The container deployment (the command line app and the local console) uses these services only for a WebRTC exchange through them: inviting at the hosted site's address reads one public file from it, and the exchange then uses the project's coordination server, and the relay and registrar where the invitation names them (PRIVACY.md, Container deployment).
| Service | What it receives | What it stores | How long | Where it runs, and who operates it |
|---|---|---|---|---|
| Hosted site (the application's pages) | Each page request: client IP address, path, time. No exchange data (PRIVACY.md, Hosted web application). | Nothing kept by the project: static files, no server-side code, no log of page loads (verified 2026-10-07). Cloudflare keeps its own request records (PRIVACY.md). | Cloudflare request analytics: at least 31 days, no maximum stated. Raw request logs: not kept unless turned on; not checked for this zone (PRIVACY.md). | Cloudflare Pages, a third party; the project builds and uploads the pages (DEPLOYMENT.md, The project's hosted web deployment). |
Coordination server (signal.data-bridge.org) | Setup messages between the two parties, derived rendezvous identifiers, connection times, client IP addresses, and browser request headers such as user agent and origin. Not exchange content, which is end-to-end encrypted (PRIVACY.md; SECURITY_DESIGN.md, Channel security). | Access log: time, client IP address for a request to port 8443 (127.0.0.1 for one through port 443), method, path without query string, status, Upgrade header, bytes, duration, request length, and the coordination server's status, connect time and response time; no user agent, no rendezvous identifier (scripts/broker-front.test.mjs). Error log: critical errors only; a refused, reset, timed-out, too-large or buffered request writes no line, so no line holds a request line, query string or client IP address for one (scripts/check-broker-front-logs.mjs). Lines written before that limit hold the request line with its query string, the client IP address, and the Host and Referer headers (measured 2026-10-26). Server output: start-up and service lines (PRIVACY.md; infra/broker/README.md, Logging). | Each log line: about 90 days after the newest entry in its file (scripts/relay-logging-posture.test.mjs). | A project host on Amazon Web Services (AWS), us-west-2, behind a project TLS front. AWS hosts the machine and holds its disk. Not carried by Cloudflare (PRIVACY.md). |
TURN relay (turn.data-bridge.org) | Each listing party's IP address and port, connection times, traffic volume; the address whether or not traffic is relayed. Encrypted packets, not decrypted (PRIVACY.md, What supporting services can observe). | No relayed traffic. Log lines: a failed login with the credential's username (an expiry time and a fixed label); a refused peer address; a socket error with the client's address and port (webrtc-relay-deployment.md, What the relay host keeps; scripts/relay-logging-posture.test.mjs). | Each log line: about 90 days, as above. | The same host, run by the project. Used on the terms in PRIVACY.md, Hosted web application (DEPLOYMENT.md, The default relay). |
| WebSocket relay (on the same host, under a name of its own) | Each party's hello: the exchange id and a proof that the party holds the exchange's relay key, not the key itself (WEBSOCKET_RELAY.md, The hello). Each party's address, pairing time, volume each way, key-exchange frames (no linkage identifier, no exchange data), and every later frame encrypted, with its sequence number and size (web-websocket-transport.md, What the relay's operator sees). The host's port 443 front terminates its TLS (infra/relay/README.md, The WebSocket relay). | Reads exchange keys from the relay's table and writes nothing to it (WEBSOCKET_RELAY.md, The key table). Log lines: one per start, a warning when the key table cannot be read, and its faults, each limited to one a minute; a fault about one exchange names its exchange id (infra/relay/README.md, The WebSocket relay). | Each log line: about 90 days, as above. | The same host, run by the project, under a DNS name that is neither turn.data-bridge.org nor registrar.data-bridge.org. Named by a hosted site only where its build sets VITE_DEFAULT_RELAY_WEBSOCKET_URL (DEPLOYMENT.md, The default relay). Contacted as each rendezvous starts; carries the exchange only when no WebRTC path opens (WEBRTC_TRANSPORT.md, Falling back to the WebSocket relay). |
Relay registrar (registrar.data-bridge.org) | From each party of an exchange that uses the relay, before it connects: an exchange id and a relay key, both derived from the shared secret, the party's IP address, and the time. Never the shared secret (PRIVACY.md; PROTOCOL.md, Enrolling at a default relay). | Exchange id and relay key, in the relay's table. One log line per request (method, path, status) and one per enrollment (exchange id, time, outcome); no IP address or key in any line. The IP address is held in memory for rate limits only (infra/relay/README.md, The registrar; scripts/relay-exchange-keys.test.mjs). | Table entry: 70 minutes after enrollment, then deleted within about 11 minutes (infra/relay/alcove-relay-sweep.timer). Log lines: about 90 days, as above. Address in memory: until its 10-minute window or 70-minute entry has ended and a later enrollment arrives, or the registrar restarts. | The same host, run by the project. |
Every log above is kept in that host's system journal, which nothing copies off the host (PRIVACY.md). The journal can also delete entries sooner when it reaches its size limits, which are journald's defaults. The host's port 443 front, which routes connections to the coordination server, the TURN relay, the WebSocket relay and the registrar (infra/relay/README.md, The 443 front), keeps no access log; its error log names a client's IP address when a service refuses, times out, or resets that client's connection.
Besides Cloudflare, two other third parties are involved: AWS, which hosts the project's host and can observe its network metadata, and Google, whose STUN server learns each browser's IP address where neither the browser's relay settings nor the invitation names a STUN server, with one exception stated in PRIVACY.md. A repository check guards these statements against new hosts in the shipped source, within stated limits (PRIVACY.md, The project's role).