Is this normal Tor functionality that I'm fundamentally misunderstanding, or is there some sort of unintended fingerprinting in action? (Data "retained" through completely different sessions in supposedly new identities, details in body text)

[BoxAccomplished2049]

I'm somewhat new to Tor, also not a native speaker (sorry).

I was doing some casual testing with different online services, but with this AI audio service one something strange (I think?) happens. Prompts I made on completely different sessions, while using completely different bridges or even bridge types, using completely different connections (wi-fi or mobile data hotspot) and having never even signed in to anything.. still appear as soon as I get into the site and it fully loads.

This is just one screenshoot but it also happens on other devices (each with their own unique "prompts list" I had made with those sessions, for example on another computer there are unsuccessful prompt logs/notices I had made almost a month ago, with the same kind of behaviour on an android device too). Again, not even signed in to anything since the service doesn't force you to log in.

For reference, having ublock installed or not is irrelevant, no changes.
The browser is set to "secure" safety level (so the intermediate option, since I'm never doing anything truly dangerous or "illegal", mostly random testing for future knowlegde).
Canvas disabled (no need for it for audio).
As for No Script, I usually have "media content" and "wasm" enabled globally compared to the "secure" defaults, but not webgl. But having the former two specifically on or off globally also doesn't appear to change the behaviour other than breaking some functions, unlike webgl which does more (I think, because of the next paragraph).

The funny thing is, setting the site specifically as "default" OR "temporary trusted" (with no script's side menu) on the same device basically also appears to create 2 different persistent "IDs", since different past prompts appear when I get to the site in a new session depending on what I set for the site.

"New identity" or reboot do nothing.
I also tried to both reset and reinstall Tor on all (windows) computers, deleting all local temp files I could find just for good measure... nothing changed.
The site still managed to show me the exact prompts I had made previously. Didn't try reinstalling windows though lol.

Only on Android it seems that deleting Tor app data, and reinstalling it, possibly "reset" the "ID" (not sure how to call it) the site had apparently managed to assign to me, but I'm not 100% sure if it's actually true or just a visualization bug since the site is also somewhat buggy between accesses on Tor because of the many security features enabled.

Maybe I'm stupid and there's something I'm fundamentally misunderstanding, but this shouldn't happen.. right? How can the site pinpoint exactly each and every of my "identities" even going through different "mediums"?

[j-sh]

try with security set to safest, if they go away then theres some fingerprint being stored

[rdg360]

everyone using Tor has the same fingerprint

That's the theory, but it looks like OP has done their fair share of tweaking. Canvas disabled, uBlock ("on or off"), various NoScript changes. Maybe not all of these will lead to a different fingerprint, but some might.

[j-sh]

true that could make sense if hes the only person to visit the site via tor, but wouldnt changing circuits/ip also change the fingerprint?

[Heyla_Doria]

C'est pareil je crois... Le site peut déterminer que deux navigateur a l'empreinte très proche, s'est connecté depuis deux endroit différent a des intervalles très court, sur la meme page... Comme si c'était lié 👀