Privacy Policy

The short version: this Site sets no cookies, runs no third-party trackers and requires no account. It does keep its own basic visitor statistics — how many people are reading it, which pages, and roughly where in the world from — and it is built so that those statistics cannot identify you: your IP address is cut down to a network block before anything is written, and it is never stored in full. This policy explains exactly what happens when you use the Site.

Who we are

The Humanoid Benchmark (the "Site") — including the Xodexa Humanoid Index (XHI) ranking and the humanoidindex.io domain — is operated by autogovern.io ("we", "us", "our"). This policy applies to everyone who visits or uses the Site.

Information we collect

We do not collect personal information through the Site. Specifically:

• No cookies. The Site sets no cookies of any kind — not for the public pages, and not for the administrative review-queue tool, which is authenticated by a bearer token in the request rather than a browser session.
• No third-party analytics or tracking scripts. We run no Google Analytics, tag manager, advertising pixel, or any other third-party JavaScript, and nothing on this Site follows you to any other site. We do keep our own first-party visitor statistics, entirely on our own server — described in full in the next section.
• No accounts, sign-ups, or forms that collect personal data. There is no registration, newsletter, comment system, or contact form. The search box on every page submits your query as part of the page URL to filter results on our server; we don't log, store, or otherwise retain search queries or associate them with you. Our visitor statistics record the page path only and discard the query string, so what you searched for is never written down.
• No sale or sharing of personal data. We have none to sell or share.

Our own visitor statistics

We count visitors so we know whether anyone is reading the benchmark and which parts of it. This runs on our own server, feeds an internal dashboard only, and is never published, sold, shared, or used for advertising. Here is precisely what a single page view records:

• A truncated network, never your IP address. Your address is cut to its surrounding network block — the first three of four numbers for IPv4, the first 48 bits for IPv6 — and the remainder is discarded in memory, before any database write happens. The full address is never stored, never logged, and never transmitted anywhere by us. A network block typically covers hundreds of separate addresses, so it identifies a rough location and an internet provider, not a person or a household.
• A visitor identifier that expires daily. To tell one visitor from two, we compute a one-way cryptographic hash of the network block, your browser's user-agent string, and a secret that we rotate every day. The result cannot be reversed to an address, and because the secret changes at midnight UTC, the identifier for the same visitor is completely different the next day. This is deliberate: it lets us answer "how many people visited today" and makes it impossible for us to answer "what has this person read this month."
• The page path, without its query string — /robot/figure-02, not what you typed into the search box.
• The referring site's hostname only — that you arrived from news.ycombinator.com, never which page or search on it.
• Your browser's user-agent string, and the browser, operating system and device type we derive from it; the timestamp; and the HTTP status we returned.

We set no cookie and store nothing in your browser to do any of this. There is no cross-site tracking, no profile, no advertising identifier, and no attempt to link your visits to any other service.

How location is determined. To turn a network block into a country and city, we look it up against ip-api.com, a geolocation service. Only the truncated network block is sent — never your full address, and never anything else about you or what you were reading. Each block is looked up once and the result cached, so repeat visits from the same network involve no further lookup.

Automated crawlers. Requests from search-engine and AI crawlers — Googlebot and Google's other agents, Bingbot, and similar — are identified and excluded from the visitor counts, and counted separately as crawler traffic.

How long we keep it. Page-view records are deleted after 180 days. The cached location lookups contain no visitor data at all — only "this network block is in this city" — and are kept so that a returning network never has to be looked up a second time.

Turning it off. Because there is no cookie or browser storage involved, there is nothing for you to clear or opt out of on your side — and equally, nothing about you persists between days. If you would prefer not to be counted at all, a browser or network-level blocker will not help, since the counting happens on our server; write to us at governance@autogovern.io instead and we will tell you what we can do.

Third-party images

Robot, company, and component-manufacturer photos shown on the Site — including on robot detail pages, the Companies pages, and the Parts pages — are linked directly from the sources we cite for each image rather than copied onto our own servers. Each individual robot page additionally shows an explicit "photo source" credit link for its main photo when one is available. When your browser loads a page with one of these photos, it makes a direct request to that third party's server, which may log standard connection information (such as your IP address) under its own privacy practices — we don't control this. We set referrerpolicy="no-referrer" on every such image, sitewide, so your browser does not send the referring page's URL along with that request, but we encourage you to review the privacy policy of any third-party site you're referred to. We do not embed any third-party widgets, iframes, or social-media embeds anywhere on the Site.

Hosting and technical logs

The Site's own application code reads your IP address in order to truncate it, as described above, and persists only the truncated form. The Site is hosted on Railway's infrastructure; as with any hosting provider, the underlying network and servers may generate standard, short-lived technical/security logs (e.g. connection timestamps and full IP addresses) as a normal part of operating the service, independently of anything our code does. Those logs are managed under Railway's own privacy practices, not ours — see Railway's privacy policy for details.

Children's privacy

The Site is a general-audience research/reference tool and is not directed at children under 13. We do not knowingly collect personal information from anyone, including children: there is no account, no form, and nothing a visitor of any age can submit to us. The visitor statistics described above are anonymous by construction and are not capable of identifying a child or anyone else.

International visitors

autogovern.io operates from the United States, and the Site's hosting provider (Railway) may serve or process traffic from infrastructure located in the United States or other countries. If you access the Site from outside the United States, be aware that the technical request needed to load the page may be processed outside your own country, and that the truncated network block described above is sent to a geolocation service that may itself be located outside your country. Where the GDPR or a similar law applies to you, our basis for keeping these statistics is our legitimate interest in understanding whether and how the Site is being read, and we have minimised the data to the least that can serve that interest: no full address, no cookie, no cross-site tracking, and an identifier that expires every day.

Your choices

We hold no account, profile, or contact record for you, so there is generally nothing on file for you to access, correct, or delete. We want to be straightforward about the one limit on this: because the visitor statistics are anonymous by design and carry no full IP address and no durable identifier, we have no way to find "your" rows in order to show or delete them, and we would have to collect more about you than we do in order to gain one. Those records delete themselves after 180 days regardless. If you have a specific privacy question or concern about the Site — including about the third-party image-hosting behavior described above — contact us at governance@autogovern.io.

Changes to this policy

If our practices change — for example, if we ever add analytics, an account system, or a mailing list — we will update this page and its effective date above. Continued use of the Site after a change constitutes acceptance of the updated policy.

Contact

Questions about this policy: governance@autogovern.io