Glassbox Auditing (glassboxauditing.com) · last updated 26 October 2026
Glassbox Auditing is a research site that collects free public information about markets, companies, governments
and public figures and shows it with a link to where each item came from. This page explains what the site collects
about visitors and about the people and organizations it covers.
The site is operated by Glass Box Auditing, a sole proprietorship based in California, United States (trade name Glassbox Auditing).
Visitors
No sign-up is needed. You can read every public page without an account.
Optional accounts. Study, Notes, the Pit and the Custom Terminal let you create an account. For an account the site
keeps your username, a salted hash of your passcode (never the passcode itself), what you save (study progress, notes,
panel layouts), and the IP address and time of registration and of each sign-in, to stop abuse of the public
leaderboard. IP addresses are never shown on the site. Sign-in records are not deleted automatically; ask for them to
be deleted with the account (see below).
The Pit. The Pit lets anyone post trade ideas, as a guest or with an account. What you post there is public:
the name, picture and short bio you give, the handles you list for other sites, your ideas, replies and likes, and
when you posted them. A guest name is tied to a random key kept in your browser's storage; the site keeps only a
one-way hash of that key, so a guest who clears the browser's storage can no longer edit or delete what the name
posted. Pictures are re-encoded by the site, which keeps nothing else from the file (such as where a photo was
taken). The site records the IP address each guest name was made from and each post and report came from, to limit
spam and to count reports once per connection; IP addresses are never shown on the site. Reports and the reasons
given are seen only by the operator. Deleting a post removes its text; ask for the rest to be deleted (see below).
Cookies. The site itself sets only first-party cookies: two that mark which Social posts are new since your last
visit (kept for a year), a security cookie that the terminal's page framework sets to block forged requests (ends
when you close the browser), the Notes sign-in cookie, and the analytics opt-out cookie (both described below).
Browser storage. Preferences and work you do on the site are kept in your browser's own storage, not in
an account, and the site does not save them: followed tickers, the time of your last visit, day or night display,
drawer and layout sizes, chart drawings and settings, the options replay's practice account, saved traffic cameras,
a guest's notes, a Pit guest key and an unsent Pit draft. Followed tickers and the time of your last visit are sent with the feed's requests, only to
choose what it shows.
Hosting. Requests pass through Cloudflare, which processes your IP address and request details to deliver
and protect the site (Cloudflare's privacy policy). Cloudflare
asks your browser to report failed attempts to reach the site to Cloudflare (Network Error Logging); successful visits
are not reported. Cloudflare sets no cookie on ordinary visits, but may set its own security cookie when it checks a
request for automated traffic. The site's own web server does not record visitors' IP addresses in its logs. From
28 September to 14 October 2026 its request log did; those lines stay on the operator's computer and are not
shared.
Content loaded from other services. Some things you see are loaded by your browser straight from the
service that publishes them, and that service receives your IP address and the request, under its own privacy policy:
videos and video stills from YouTube (its privacy-enhanced youtube-nocookie.com player); company logos from
logo.freehire.me; photos from Wikimedia Commons, the public-domain Congress portraits on unitedstates.github.io, Reddit and the
social networks whose public posts are shown; map tiles and terrain from OpenStreetMap, OpenRailwayMap, Esri, CARTO
and Re:Earth; code libraries and fonts from jsDelivr, unpkg, cdnjs and Google Fonts; live camera images and video
from the transport agencies that publish them; live TV and radio streams from their broadcasters; flight routes from
adsb.lol; and the Discord chat, if you open it. The site adds no tracking to these requests.
Visit statistics. To learn which pages are useful, the site records the pages you view, the search terms
you type in the terminal and the companies you look up, how long a page is on your screen, your approximate location
(country, and where Cloudflare reports them, region, city, time zone and a position rounded to about 11 km), the
website that linked you here (its domain only), any campaign tags in the link, and your type of device, browser and operating system.
It keeps no IP address and sets no cookie for this: visits are counted with an anonymous code made from your IP
address and browser that changes every day, so one day's visits can't be linked to another's. Browsers that send
Global Privacy Control are not recorded. You can also exclude this browser from site
analytics. That choice sets a first-party exclusion cookie, with no unique identifier, for up to 400 days;
clearing site cookies removes it. Excluded browsers receive no visit-tracking script or advertising script.
These records are kept for 180 days; after that only daily totals by page and country remain, with no visitor
code.
Notes sign-in. If you sign in to Notes or the Pit, the site sets one first-party cookie that keeps you signed in for up
to 7 days; the page's scripts can't read it, and signing out removes it.
The site does not sell personal information and does not build profiles of its visitors.
People and organizations the site covers
The site shows only information that is already public: official filings and registers, public databases such as
Wikidata, news reports, and public posts by public figures and organizations on their own social media accounts.
Social media posts are read through each platform's public interfaces (for example Meta's Instagram Graph API,
the Threads API and Facebook Page public content, Bluesky's and Mastodon's public APIs, YouTube's Data API, X's public
embedded timeline, RSS feeds and public channel pages) or from a public archive of them (CNN's archive of Donald
Trump's Truth Social posts), and only for accounts that a public source ties to that person or organization. The
site never reads private accounts, private messages or anything behind a login, and it never tries to identify
private individuals.
Each post is shown as published, with its date, its public engagement counts and a link to the original.
Nothing is scored or used to target anyone, and nothing is sold or shared with third parties.
Data from Meta platforms (Instagram, Threads and Facebook) is used only to show those public posts and their
public counts on this site, is kept only as long as it is shown, and is deleted when Meta or the account holder
asks. The Threads API is used only to read the public profiles and public posts of the public accounts the site
covers; the site never posts, never reads messages and never accesses another business's account.
Your choices and data deletion
To delete an account with its progress, notes, Pit posts and sign-in records, to delete what a Pit guest name
posted, or to ask for posts or information about you to be removed or corrected, email [email protected] with the page link and what you would like changed. Requests are answered within 30 days.
Information from Meta platforms about you is removed on request, or within the period Meta requires after a
deletion notice.
Changes
Changes to this policy are posted on this page with a new date.