Website privacy.

This page describes the public website, torana.sh. It does not add telemetry to the Torana proxy running on your machine, or send your agent traffic to a website analytics service.

Website analytics

Cloudflare serves the production website and can provide privacy-focused Web Analytics when that feature is enabled in the Cloudflare dashboard. It measures aggregate page views, visits, referral sources, browser characteristics, and page-load performance. Cloudflare injects its analytics beacon at the production edge; local and preview builds do not include it in their generated HTML.

We also use Umami on https://torana.sh to count page views and a small set of useful actions that Cloudflare Web Analytics does not record: opening project links and successfully copying a plugin install command. Umami collection stays off on local and preview addresses.

These counts help us improve the documentation and routes into the project. A quickstart visit or a copied command does not tell us whether someone installed Torana or used it successfully.

What the analytics services receive

The site sends a known public page path, such as /quickstart/. For a key link or successful copy, it also sends fixed labels for the action and its position in the header, page body, or footer. A recognized referring site, such as LinkedIn, GitHub, Reddit, or a search engine, is reduced to a fixed source origin. Unknown or missing sources stay unattributed.

For our PII launch article, the known LinkedIn post link can also produce a launch-visit event with fixed source, medium and post labels. We recognize only the exact published attribution values; arbitrary query values are not forwarded.

Analytics payloads exclude raw URL query strings and fragments, referrer paths, page text, form values, clipboard contents, credentials, and information from your local Torana instance. We do not call Umami’s identify feature, attach account identities, or enable session recordings, heatmaps, or automatic interaction capture.

When analytics is enabled and your browser permits it, requests go to Umami Cloud. Like other web requests, they expose request metadata such as an IP address and browser information to the service. Umami may derive location and pseudonymous session or visit statistics from that metadata. We use aggregate reports; this is not a claim that the provider receives no data or cannot group events within a session.

The site adds no analytics cookies or persistent visitor identifier. Umami keeps a response cache in memory and can read its own browser opt-out setting. See Umami’s metric definitions and privacy policy for the provider’s handling of data.

When Web Analytics is enabled in the Cloudflare dashboard, its beacon adds aggregate page and performance measurements to the request metadata Cloudflare already receives while serving the website. Cloudflare documents Web Analytics as not collecting or using visitors’ personal data. The production beacon reports through Cloudflare’s infrastructure independently of Umami.

Your browser preferences

If your browser signals Do Not Track or Global Privacy Control, the site does not load the Umami tracker. It checks those preferences again before sending an Umami event. Those signals do not suppress Cloudflare’s edge-injected Web Analytics beacon; a content blocker can stop either beacon. Navigation, command copying, and the rest of the site work without analytics.

Hosting and appearance

Cloudflare serves this website, and Google Fonts serves its typefaces. Those services receive normal web-request metadata independently of the browser analytics described above. The optional theme control stores your appearance choice in this browser; that setting is not used for analytics.

Read Cloudflare’s privacy policy and Google’s privacy policy for those services. For the proxy’s local behavior, start with the quickstart and support matrix.