What NumberDB records about you, why, and what you can do about it. Last changed 10 August 2026.
Searching for a number, reading a table and following a citation require no account and record nothing about you personally.
The server keeps a short technical log of requests, as every web server does. A line looks like this, and this is genuinely all of it:
203.0.113.0 - [10/Aug/2026:14:22:07 +0000] "GET /T42 HTTP/1.1" 200 18443 "-" "Mozilla/5.0 ..." 0.031
The address is masked before it is written. The last part of an IPv4 address is replaced with a zero and an IPv6 address is cut to its network prefix, so what is stored identifies a network and not a person. That is enough for the two things the log is for — noticing that something is hammering the server, and finding out why a page returned an error — and not enough to follow one reader around the site. Nothing at all is written to a database when you read a page.
Nothing on any page is fetched from another company's server. Fonts, formula rendering and syntax highlighting are all served from here, so no third party learns that you visited, or which page. This was not always true; it is now, and a test keeps it that way.
Reading NumberDB sets no cookies whatsoever. You can check in your browser. A cookie appears only when you do something that cannot work without one:
| Cookie | When it appears | What it does |
|---|---|---|
csrftoken | When a page shows you a form — signing in, signing up, editing | Stops another site from submitting that form on your behalf. Without it the form is refused. |
sessionid | When you sign in | Remembers that you are signed in. Delete it and you are signed out. |
messages | Briefly, to carry a notice like “saved” across a redirect | Holds the notice until the next page has shown it, then goes. |
All three are strictly necessary to do the thing you asked for, and none of them is used to learn anything about you. Under the ePrivacy rules (in Germany, § 25(2) TTDSG) that kind of storage needs no consent, which is why this site has no cookie banner. A banner here would ask you to agree to something nobody is doing.
There are no analytics cookies, no advertising cookies and no third-party cookies, because there is no analytics, no advertising and no third party.
An account exists so that edits can be attributed and so that a person can be written to about their own work. It stores:
| What | Why |
|---|---|
| Username | Shown beside every edit you publish. Chosen by you, and it need not be your name. |
| Email address | Confirming the account, resetting a password, and writing to you about your own edits. Never shown on the site. |
| Password | Stored only as a slow one-way hash. It cannot be read back, here or by us. |
| When you joined and last signed in | Recognising abandoned and compromised accounts. |
| API keys | The label you gave, the first few characters, when it was made and last used, and a hash of the key. The key itself is shown once and never stored. |
| Your edits | See below. These are public. |
Then GitHub tells us your account id, your username and your email address, and we keep those to link the two accounts. No access token is kept, so this site cannot act on GitHub as you, then or later. GitHub learns that you signed in to NumberDB, because you went there to do it — their privacy statement covers what they do with that. Nothing about you is sent to GitHub unless you choose that button; the sign-in page itself contacts nobody.
NumberDB is a record of where numbers came from, and that record is the point of it. When you publish an edit, the site keeps — publicly and indefinitely — the content you wrote, the message describing your change, the time, and the username it was published under. Anyone can read the history of any table.
This does not go away when you delete your account. Deleting your
account removes your username, email address, any linked GitHub account and all
your API keys, and the edits are re-attributed to a placeholder
(deleted-user) — but the edits themselves stay, because
removing them would break the provenance of numbers other people are relying
on, and in many cases would silently change published mathematics. If that is
not acceptable to you, the moment to decide is before you publish.
Your username is what appears there. If you would rather not be identifiable in the record, choose a username that does not identify you: it is never matched against your email address anywhere on the site.
Every request to /api/ is logged, on one line, with the
endpoint, whether it succeeded, how long it took, which API key or account was
asking, and what the client called itself:
{"actor": "key:aB3dE5gH7jK9", "client": "numberdb-python/0.1.0", "event": "api",
"method": "POST", "ms": 412, "path": "/api/table/T42/entries", "status": 200}
A key is identified by its first few characters — the same ones shown on your keys page — and never by the key itself. No IP address appears in this log, because the web server's log already has one, masked, for a different purpose; recording it twice for one use would be collecting more than is needed.
client is whatever the calling program says it is. The
numberdb package says its version, and that is deliberate: the API
is used by scripts that run for hours, and knowing which versions are actually
in use is what makes it possible to change something without breaking them
silently. It says nothing about your machine — not your operating system,
not what you have installed, not what you were computing. The package does not
look, and the site does not ask.
Most of the tables here were first written in a public git repository, and the site read that repository's history to work out who wrote what. So the database holds names and email addresses taken from public git commits, for people who may never have had an account here.
Only the name is ever displayed. The email address is stored because it is what distinguishes two contributors with the same name, and it is not shown on any page, in any table, or through the API. If you are in that list and would rather not be, write and it will be removed.
| Who | What for | Where |
|---|---|---|
| Akamai (Linode) | The server this site runs on, and everything stored on it | New Jersey, United States |
| Mailgun | Sending account emails: confirmation, password reset | United States |
| GitHub | Only if you choose to sign in with GitHub | United States |
That is the complete list. There is no analytics provider, no advertising network, no content delivery network, no error-reporting service and no customer-support tool, because there is nobody selling anything here.
The server is in the United States, so if you are in the EU or the UK your data is transferred there. That transfer is necessary to provide the site you asked for. Nothing is sold, and nothing is shared with anyone not named above.
| What | How long |
|---|---|
| Web server logs (masked addresses) | Rotated automatically; a few weeks at this site's traffic, and never more than 30 MB per service |
| API activity log | The same rotation |
| Your account | Until you delete it |
| API keys | Until you revoke them; a revoked key is kept as a record that it existed, and is deleted with the account |
| Published edits | Indefinitely, as described above |
| Database backups | Up to 60 days. Something you delete today is gone from the site at once, and gone from the last backup that contains it within 60 days. |
For readers in the EU and the UK, under Article 6(1) GDPR:
There is no automated decision-making and no profiling.
You can ask for a copy of your data, correct it, have it deleted, restrict or object to what is done with it, and take it elsewhere. Two of those you can do yourself, immediately, without asking anyone:
For anything else, write to matschke@numberdb.org. A person reads it. If you are in the EU or the UK and you think this site has handled your data badly, you can also complain to the data protection authority where you live.
If this changes in a way that matters, the date at the top changes and the change is described here. The page's whole history is public, in the same repository as the site itself, so you can see exactly what it used to say.
Who runs this site, and how to reach them: legal notice.