Privacy and GDPR

Statsy is built so that most sites need to store nothing about a visitor at all. This page is a practical summary; the privacy policy, cookie policy and Data Processing Addendum are the documents that actually bind us.

Who is who

For visitors to your website, you are the controller and Statsy is the processor, under the DPA. Under US state privacy laws Statsy acts as a service provider; under India’s Digital Personal Data Protection Act, 2023, you are the Data Fiduciary and Statsy the Data Processor. The DPA applies automatically as part of the terms, and a countersigned copy is available on request.

What the script collects

• Page address and time, referrer, UTM tags and ad click identifiers. Other query parameters only if you turn that on.
• Browser, operating system and device type from the user agent, plus screen size, language and time zone.
• Country, region and city from the IP address, with the city’s coordinates rounded to about a kilometre.
• The events you set up: signups, clicks, scroll depth, and payments linked to a visit.
• If you turn them on: session replays with form inputs masked, click positions for heatmaps, and page performance timings.
• Identities — email, name, user id — only if you call statsy.identify(). That is your decision and your responsibility.

IP addresses are not stored

The IP address is used for the location lookup and, in cookieless mode, to build a daily key. The key is a hash of a secret that changes every day, the site, the address and the browser. The secret is deleted after two days, so a stored key can never be traced back to an address or linked across days. The address itself is never written down.

Cookieless mode and consent banners

In cookieless mode nothing is stored in the visitor’s browser at all. In many cases that removes the need for an analytics consent banner, though rules differ by country and configuration and the notices on your site remain yours. In Auto mode — the default — visitors from the EU, EEA, UK and Switzerland are counted without cookies automatically. See Tracking modes for what each mode stores.

Note. Statsy sets no third-party cookies, does no cross-site fingerprinting, uses no ad networks and never tracks a visitor across different websites.

Do Not Track and Global Privacy Control

By default the script sends nothing at all from a browser with Do Not Track or Global Privacy Control switched on. You can turn that off with data-ignore-dnt if you would rather count those visits, and Global Privacy Control then still forces cookieless mode unless the site is set to Full.

A visitor can also opt out for themselves. Setting the local storage key statsy_optout to 1 stops the script sending anything from that browser, which is what an opt-out button on your site should do.

localStorage.setItem('statsy_optout', '1');

How your data is used

It is never sold, never shared for advertising, never used for profiling and never combined with another customer’s data. Only aggregated, de-identified measurements such as event volumes are used to run the service. You own your data and can export it whenever you want.

Data subject requests

Visitors to your website should contact you; we help you answer, including deleting a specific visitor’s data on request. For your own account data, email support@statsy.co and we reply within 30 days. Do not send special category data, card numbers, passwords or government identifiers in URLs, events or identify calls.