Privacy and compliance

The short version: Statsy is cookieless for visitors in the EU, EEA, UK and Switzerland and for anyone sending Global Privacy Control, stores no IP addresses, sets no third-party cookies, masks every form field in replays, and keeps raw events for 90 days. The detail is below, with links to the full pages.

What is stored in the browser

Which mode applies is decided per visitor by the site setting, the country and the browser's signals. See Tracking modes.

IP addresses

The IP address is used twice and stored never: to look up country, region and city, and in cookieless mode as one input to the daily key. The secret behind that key is deleted after two days, after which the key cannot be tied to an address even by us. Exports, the API and the dashboard have no IP field.

Browser signals honoured

• Global Privacy Control and Do Not Track: the script sends nothing at all. Not a pageview, not a heatmap hit, not a replay. A site can override this with data-ignore-dnt="true"; a GPC visitor is then still measured cookieless.
• Sec-GPC on the request: when a beacon does arrive with it, because the site set data-ignore-dnt, the server forces cookieless mode for that visitor whatever the site setting.
• Opt-out: statsy.optOut() sets a local storage flag and the script stays silent on that browser until statsy.optIn(). An opt-out link for your privacy page is one line.

<button onclick="statsy.optOut(); this.textContent='You are opted out'">Opt out of analytics</button>

Consent

Cookieless mode stores no identifier, which in many places means no analytics consent is needed for it. If you run a banner anyway, or want full mode for visitors who agree, wire the banner to statsy.consent(). Granted switches that browser to full mode, denied clears the cookie and stays cookieless. The choice is remembered.

banner.on('accept', () => statsy.consent('granted'));
banner.on('reject', () => statsy.consent('denied'));

Replays and heatmaps

• Replays record full-mode visitors only, at the sample rate you set, and every input field, passwords included, is masked. That cannot be turned off.
• Heatmaps are positions aggregated per page; no click is stored with a visitor.
• A CSS selector under Site settings › Replays blocks elements whose content should never appear in a recording, such as an account page or a chat widget.

Events and identity

• Automatic events never read form values, file contents or typed text. See Events captured automatically.
• Search queries are the exception by design: they are what the visitor typed into your search. Switch URL capture off if that is not appropriate for your site.
• Identity traits from statsy.identify() are stored in your workspace only, never in public share links or the share API.

Retention

Full table and the purge schedule: Data retention.

Data subject requests

Delete one visitor by id, delete a date range, or delete the site, from Site settings › Danger zone or the API. Exports of any report are CSV. The Data Processing Addendum covers the processor relationship, and Privacy and GDPR covers roles and sub-processors.

Note. Rules differ by country and by what your site does. This page describes what the software does; whether that satisfies your obligations is a question for you and, where needed, your counsel.

Frequently asked questions