Privacy levels · exe.st

DESCRIPTION

Sites that use exe.st carry a one-line privacy footer covering seven things: ads, tracking, cookies, logging, JavaScript, embeds, and third-party requests. Each item names a level defined on this page and links to its definition.

Site owners don’t write the footer. Each site declares its levels in its settings, and the deploy step checks the site against them, refuses to publish if the site goes beyond them, and writes the footer itself. See VERIFICATION.

EXAMPLE

Privacy: no ads, no tracking, no cookies, no logging, no JavaScript,
no embeds, and no third-party requests. Checked on every deploy
since 2026-11-13.

The date is when the checks started for that site, not when it was last published.

LEVELS

Each item has three levels, from most to least private.

none: The site shows no advertising.
first-party: Ads are served from the site’s own domain, chosen without any information about you, and nothing about your visit is sent to advertisers.
third-party: Ads come from an ad network, which can receive your IP address and details about your browser and may set its own cookies.

Tracking

none: The site doesn’t count, profile, or follow visitors: no analytics, tracking pixels, or fingerprinting.
aggregate: The site counts visits on its own servers, without cookies or identifiers, as totals that can’t be tied to you or combined with other sites.
third-party: An outside analytics or tracking service receives information about your visit.

Cookies

Covers cookies and any other storage in your browser, such as local storage.

none: The site stores nothing in your browser.
essential: Only first-party storage needed for something you chose to do, such as staying signed in. Never used for tracking or advertising, and kept out of reach of scripts where the browser allows it.
non-essential: The site stores data in your browser for other purposes, or without you doing anything that needs it.

Logging

none: The site keeps no record of requests. Each request is processed only to answer it.
operational: The site’s server code keeps error and diagnostic logs, without IP addresses or full request records, deleted automatically after 30 days or less. Page requests aren’t logged.
access: The site keeps a record of each request, which can include your IP address, the page you asked for, and your browser.

JavaScript

none: The site runs no scripts. Everything works with JavaScript turned off.
first-party: Scripts come only from the site’s own domain and talk only to that domain.
third-party: The site runs scripts from other domains.

Embeds

none: Nothing from another site is embedded: no videos, maps, social posts, or widgets.
click-to-load: Embedded content from another site loads only after you click it. Until then, nothing is requested from that site.
third-party: Embedded content from other sites loads with the page.

Third-party requests

Counts what your browser fetches on its own while loading and using a page. Links you follow and forms you submit don’t count; those are your choice.

none: Your browser contacts only the site’s own domain.
listed: Your browser also contacts a short, fixed list of other hosts, named in the site’s privacy policy. The browser blocks any host not on the list.
unrestricted: The page can contact other hosts without a fixed list.

VERIFICATION

Every deploy goes through these steps before anything is published:

enforce: The site is served with a Content Security Policy built from its declared levels, so your browser itself blocks scripts, embeds, and requests to other hosts that the levels don’t allow.
check: The deploy scans every page and stylesheet for scripts, event handlers, embeds, resources from other hosts, browser storage, and known ad and tracker domains. It reads the hosting setup for logging, log retention, and code that runs at the edge, checks the site’s server code for cookies, and confirms the site is served with the Content Security Policy its levels call for.
stop: If anything goes beyond the declared levels, the deploy fails and nothing is published.
write: Otherwise the deploy writes the footer on every page from the declared levels.

LIMITS

The checks cover what a page does in your browser and how its hosting is configured. They can’t prove what a site’s server code does with a request after receiving it; each site’s privacy policy covers that.
The first-party ads and aggregate tracking levels describe what happens on the site’s own servers, so only the parts that reach your browser can be checked.
Your browser extensions, your network, and the hosting provider’s own operations are outside a site’s control.

privacy-levels — what a site’s privacy footer means