Privacy-first analytics

Understand your website. Respect your visitors.

Get useful reports about your pages, traffic sources and goals without identifying the people who visit your website. Privacyside measures activity without tracking cookies, fingerprinting or visitor profiles.

Data we keep

A website ID, random per-event delivery receipt, approved path (or /[other]), event category, coarse traffic source/channel, and approved utm_campaign category, broad device/browser/operating system categories, and an approximate country code when available. These dimensions are aggregate activity categories, not visitor identifiers. Only enumerated property values pass validation; they are not retained in report storage. Server-assigned times are stored in UTC.

Data we discard

URL fragments, full URLs, all other query fields, arbitrary custom properties, form values, and unapproved routes. Known sensitive path patterns collapse to /[other]. Referrers become known search/social hosts, approved public referral hosts, or a generic referral category. Owners must never approve personal or sensitive values.

Measurement limits

We do not calculate unique visitors, sessions, bounce rate, duration, or exact active visitor counts. Goal completion intensity uses pageviews as the denominator and can exceed 100%. Public collection can be spoofed despite origin checks; receiving data is separate from DNS ownership verification.

Signals and consent

DNT set to 1 and Global Privacy Control suppress collection. Owners can delay tracking until consent, stop it, or opt out at site level. Cookie-free does not automatically mean consent-free; evaluate your own obligations.

Retention and erasure

Aggregates retain 30, 90, or 365 days; delivery receipts 48 hours; health counters 7 days; monthly usage 13 months; site-erasure audit 90 days. Cleanup runs daily. Site deletion cascades through active-database reports, goals, receipts, and health counters immediately. Consumed monthly quota stays counted. Backups expire according to provider policies.

Infrastructure boundary

The collector does not read or store IP addresses. It reads the user agent transiently for common-bot filtering and broad technology categories, then discards it. Country reporting uses only the hosting provider’s country code when enabled; no city, coordinates or external IP lookup service is used. Missing signals and older data remain Unknown. Vercel delivers the tracker and receives collection requests. Its network may retain IP addresses and connection metadata for security and operations, separately from our analytics database. See our privacy policy for that boundary. We do not promise zero infrastructure IP retention.

Delivery and accuracy

Blockers, privacy signals, common-bot filtering, quota caps, and delivery failures reduce observed traffic. Referrers can be unknown. One bounded retry reuses the per-event receipt to prevent double counting within 48 hours. Rate, quota, capacity, and service failures return explicit errors; accepted counts describe observed activity rather than audited human traffic.

Report exploration and weekly summaries

Page, source, channel, campaign, technology and country selections apply to totals, previous-period comparisons, goals and report exports. Search within a table narrows that table and its CSV. Recent activity and collection health always describe the whole website. Historical goals lack page and channel detail recorded before those fields were added; filtering by these dimensions excludes unavailable history.

Website owners can enable weekly reports in Settings. After 9am each Monday in the website’s reporting timezone, the latest completed Monday–Sunday is queued for their account email. Summaries contain aggregate counts and top pages/sources. They can be disabled at any time; messages already accepted by the email provider cannot be recalled.