Zum Inhalt springen

Aionity Bots

This page documents the automated requests Aionity sends, what they are for, how to verify them cryptographically, and how to control or block them.

Deutsche Fassung: aionity.app/bot?lang=de

1. Operator

All requests described here are operated by:
Marcel Herczog
c/o POSTFLEX PFX-837-041
Emsdettener Strasse 10
48268 Greven, Germany

Contact for site owners, blocking requests and complaints: kontakt@aionity.app
We usually reply within 3 business days.

2. Our bots and their purposes

We deliberately separate purposes into distinct tokens so you can allow or block them individually. A page fetched because a human just asked for it is not the same thing as an index crawl, and you should be able to decide on them separately.

Aionity is the operator, Aiory (aiory.app) is the service the fetching is done for. Index crawling and product data run under the company name because the same index is intended to serve further services in future. The user-triggered agent carries the product name instead, so you can see whose user just asked.

robots.txt token Purpose Triggered by
AionityBot Building our own search index. scheduled, background
AioryBot-User Fetching a single page because a user just asked for it – a URL pasted into the chat, or a source for their question. a human, in real time
AionityShopDiscovery Discovering product and price data for price comparison (sitemaps, schema.org structured data). scheduled, background
Aionity Descriptive short name for providers that require a descriptive user agent with contact details (e.g. Wikimedia). as above, depending on context

Full user agent strings:

Mozilla/5.0 (compatible; AionityBot/1.0; +https://aionity.app/bot)
Mozilla/5.0 (compatible; AioryBot-User/1.0; +https://aionity.app/bot)
Mozilla/5.0 (compatible; AionityShopDiscovery/1.0; +https://aionity.app/bot)
Aiory/1.0 (+https://aionity.app/bot; kontakt@aionity.app) python-httpx

We do not rotate user agents and we do not impersonate browsers. Our requests are always identifiable as automated.

3. What we use content for – and what we do not

We operate Aiory (aiory.app), an assistant that answers questions and cites and links its sources. Fetched pages serve exactly that purpose: answering a question and making the origin of the answer visible. Our signature directory states this purpose in machine-readable form ("purpose": "rag").

We do not train language models on the content we fetch. We operate no training-data crawler and we do not pass fetched content to third parties as training material.

We store an extract of the page so we can answer the same question later without fetching it from you again – this reduces the load on your server. We display your content only as a short extract with title, attribution and a link to the original.

4. How to verify it is really us

Anyone can claim a user agent. That is why we identify ourselves cryptographically.

Web Bot Auth (preferred)

We sign our requests per RFC 9421 (HTTP Message Signatures, tag web-bot-auth) using an Ed25519 key. The public half is published at: 

https://aionity.app/.well-known/http-message-signatures-directory

Our requests then carry these headers:

Signature-Agent: sig="https://aionity.app"
Signature-Input: sig=("@authority" "signature-agent");created=...;expires=...
                 ;keyid="...";alg="ed25519";tag="web-bot-auth"
Signature:       sig=:<base64>:

Verify the signature and you know for certain, independent of IP address and user agent. This mechanism is evaluated in production by Cloudflare, Akamai, AWS WAF, HUMAN, Vercel and DataDome, among others.

IP addresses

In addition, our bots fetch exclusively from these addresses, each labelled with the job it does so you can treat the two separately. Machine-readable at aionity.app/bot/ips.json: 

37.221.195.219     index and product crawl    (AionityBot, AionityShopDiscovery)
185.170.114.63     user-triggered fetches     (AioryBot-User)

This list is short and changes rarely. Should it change, we publish the update here before the new address goes into service.

5. How to control or block us

We honour robots.txt – for all four tokens, without exception. Changes take effect on our side within one hour at the latest.

Block the index crawl, keep allowing user-triggered fetches:

User-agent: AionityBot
User-agent: AionityShopDiscovery
Disallow: /

Block everything:

User-agent: AionityBot
User-agent: AioryBot-User
User-agent: AionityShopDiscovery
User-agent: Aiory
Disallow: /

Exclude only specific areas:

User-agent: AionityBot
Disallow: /internal/
Disallow: /search
Allow: /

Prefer writing to configuring? An email to kontakt@aionity.app is enough – we will exclude your domain on our side. The same applies if you want already-stored extracts of your pages deleted.

6. How we behave

  • At most one request per second per domain. We work across many different domains in parallel, not across many pages of one domain.
  • If your server signals overload or throttling, we stop fetching from you for the current run – we do not keep hammering.
  • We fetch robots.txt using our own token and cache it for one hour.
  • We follow sitemaps and structured data wherever you offer them – cheaper for both of us than guessing.
  • We do not circumvent paywalls, logins or technical access controls.
  • We do not use residential proxies or rotating identities.

7. Last updated

This information was last updated on 16 September 2026 and is always available at aionity.app/bot.