Privacy
What brocs.fyi measures, what it does not collect intentionally, and the controls applied to site analytics.
BROCS is a public reference site. It has no accounts, gated downloads, advertising, or sales lead forms. Reading the framework does not require submitting a name or email address.
Site measurement
brocs.fyi uses Google Analytics 4, property G-Y2S0F08DXN, to understand which public
pages are useful and whether people can navigate the framework. The standard service
can process page and session activity, approximate location, browser, and device
information.
This site configures the tag to:
- disable Google Signals;
- disable advertising-personalization signals;
- use session-only Analytics cookies; and
- remove query strings and fragments from the page URL and referrer sent with page views.
The last control matters on this site. Assessment selections and search terms are kept in the browser-only URL fragment. Fragments are excluded from network requests and from the page location sent to Analytics. brocs.fyi does not configure user IDs, enhanced ecommerce, or user-provided data collection.
Google describes the default information collected by Analytics in its data collection documentation and explains its processing in the Google privacy policy. Browser privacy controls and content blockers can prevent the Analytics tag from loading.
Cloudflare also supplies Web Analytics for page performance and aggregate traffic. Its
browser beacon sends timing metrics to this site's /cdn-cgi/rum endpoint. Cloudflare
documents the data collected by the beacon
and states that query strings are not logged.
Delivery and local preferences
Cloudflare processes ordinary request metadata to deliver pages and defend the site. Theme preference is stored only in the reader's browser. The interactive assessment runs in the browser; sharing a result puts the selected-state token in the URL fragment, so readers should treat a shared assessment link as disclosable information.
Updates list
Subscribing sends the email address, current page path, timestamp, and Cloudflare country code to the site's Worker. The site stores that record in Cloudflare KV until removal is requested and sends a copy through Cloudflare Email Sending. Reply to any message to remove the address.
The assessment
Two assessment features send data, and both are described here precisely because the rest of the page runs locally.
Assessment responses. Once scoring starts, the site records all twenty-five selections, the five-part score and total, a random response identifier, timestamps, completion status, and the country Cloudflare attaches to the request. Revisions update the same response. Choosing Reset starts a new response. The record contains no name, account, stored IP address, or user agent. Records expire after five years and exist to support aggregate analysis and research about enterprise AI capability coverage.
The emailed report. Asking for the report by email links the address to that assessment response, including its selections and scores, and retains the linked record for the same five-year period. Cloudflare Email Sending also processes the address and response to deliver one message. The address is added to the updates list only when that separate box is ticked. Reply to a report or updates message to request removal of an email-linked assessment record or subscription.
Abuse controls. The report, subscription, and score endpoints keep short-lived hashes derived from the requester IP address or recipient address. These rate-limit keys expire within two hours and do not contain the original value.
Changes
Material changes to what the site collects will be reflected on this page before or when the change is deployed. This notice was last updated on 28 August 2026.