Kept: a random visitor id in a first-party cookie (or, without it, a salted hash of your browser family, OS,
language and network prefix), when you came, the page paths you opened (no query string) and the site you
came from. Never your address or your full browser string.
For how long: 13 months after you were last seen, then deleted. The hash's salt changes every 30 days.
It never leaves this forge: it is shared with no one. A request with Global Privacy Control or Do Not Track
gets no cookie and no visitor record, and the owner can turn this off.