The seven observers, side by side
The whole catalogue in one view. Seven parties, what each of them holds, where that record physically sits, and what would have to happen for anyone else to read it.
Reading the cards one at a time gives depth. Reading them together gives shape, and the shape is the more useful of the two. Nearly every practical misjudgement on this subject comes from treating two observers as if they were one, or from assuming that a measure aimed at one of them helps with the others.
What each one holds
| Observer | What it holds | What it does not hold | Where the record lives |
|---|---|---|---|
| Your network | That a connection happened, when it started and stopped, and roughly how much moved. | Which site, which page, what was typed, whether an account exists anywhere. | Provider systems, on a retention schedule set by law and business practice. |
| The Tor network | One hop on either side, and nothing more. The first relay sees where you are, and it is the only one that does. | No single position sees both ends. For an onion address there is no exit relay in the path at all. | Nowhere durable by design. Relay operators are separate parties with no shared record. |
| The market server | Everything sent to it, because a form cannot be processed without being received. Times, sequences, whatever was typed. | Who you are, where you are, whether anything you typed is true. | On the server. Retention is a choice made by whoever runs it, and it is not observable from outside. |
| The vendor | A destination, an order, a moment, and a way of writing. Everything needed to send an object to a place. | Your name, unless you gave it. Whether the place is yours. Anything about your life beyond the order. | Human memory and whatever notes that person keeps, on a schedule nobody publishes. |
| The post | That an item of a certain size went from one place to another, with times attached to each step in between. | What is inside. Who handed it over, in most ordinary flows. Who the recipient really is. | Commercial and governmental records, kept for operational reasons on their own timetable. |
| Your own device | Everything, in plaintext, because it has to draw the page. Plus whatever the system wrote down while doing it. | Nothing is hidden from it. This is the one observer with no blind spot. | A physical object in your possession, which can be borrowed, repaired, sold or examined. |
| The people around you | Whatever they were told or happened to see, filtered through memory and reassembled into a story. | Precision. Human observers infer rather than record, and they are often confidently wrong. | In somebody else's head, indefinitely, with no way to check what is in there. |
The three that do not overlap
Three observers on that list know things no other observer knows, and they are the ones worth keeping straight.
Your network knows that a Tor connection happened from a particular line at a particular time, and nobody else on the list knows that. The market server knows what was typed into it, and nobody upstream of it knows that. The postal system knows that a physical object went to a physical place, and nothing in the first two sections has any bearing on it at all.
The practical consequence is that a measure aimed at one of those three does not move the other two. This is not a small point. It is the reason a person can be extremely careful about connections and completely careless about a parcel, and feel consistent the whole time.
How the sections differ in tone
The network and Tor sections are the most technical and the most reassuring, because they describe the part of this that has been thought about hardest by the most people. The market section is the plainest, because a server receiving what you send it is arithmetic rather than a threat. The vendor section is about a human being with a legitimate need to know a delivery address.
The postal section is the one that changes people's minds, because the record it describes is the one nobody upstream can touch. The device section is the longest-lived exposure on the list. And the people section is the one readers recognise themselves in, which is why it is written without a single word of scolding.
Read the catalogue in orderBack to the front page
Questions that come up
Which observer should I care about most?
That depends entirely on what you are worried about, and this site deliberately does not rank them. What it can say is that the observers people spend the least time on, which are the device in front of them and the people in the same building, hold the most detailed records for the longest time.
Does using one of the addresses at the top of this page change any of this?
The address you use changes nothing in this table. All three are printed exactly as supplied, none is tested here, and which one a person opens has no bearing on what a server receives, what a parcel discloses or what a device writes to disk.