Privacy policy

Statsy (https://statsy.co) is a web analytics service (“Statsy”, “we”). This policy explains how we handle personal data in two different situations, because our role is different in each:

• Our own customers and visitors to statsy.co. When you join the beta, create an account or use our website, we decide how that data is used. We are the controller.
• Visitors to our customers’ websites. When a customer installs the Statsy script, we process data about their visitors only on that customer’s instructions. The customer is the controller and we are their processor. Our Data Processing Addendum sets out those terms.

Questions about privacy: support@statsy.co.

On a website that uses Statsy, the script sends us:

• The page address and time, the referrer, and campaign parameters (UTM tags and ad click identifiers). Other query parameters only if the site owner turns that on.
• Browser, operating system and device type derived from the user agent, plus screen size, language and time zone.
• Country, region and city, plus the city’s approximate coordinates (rounded to about 1 km), looked up from the IP address with an offline database or our CDN’s location headers. The IP address itself is not stored. IP Geolocation by DB-IP.
• Events the site owner sets up, such as signups, clicks, scroll depth, and payment amounts linked to a visit.
• If the site owner turns them on: session replays, click positions for heatmaps, and page performance timings. Replays mask what visitors type into form fields; other text shown on the page is recorded, so site owners should not enable replays on pages that display sensitive information.

How a visitor is recognised depends on the site’s tracking mode:

• Cookieless (lightweight). No cookies and no identifier stored in the visitor’s browser. Visits are grouped on our servers with a key made from a secret that changes every day, the site, the IP address and the browser. The daily secret is deleted after two days, after which no key can be linked back to an IP address or across days. The script caches which mode applies in the tab’s session storage.
• Full. A first-party cookie, statsy_vid, holds a random identifier for up to one year so returning visits, journeys and revenue can be connected. A session identifier is kept in the tab’s session storage.
• Auto. Cookieless for visitors from the EU, EEA, UK and Switzerland and for anyone whose browser sends a Global Privacy Control signal; full for everyone else.

By default the script sends nothing when the browser sends Do Not Track or Global Privacy Control; a site owner can switch that off for their site, in which case Global Privacy Control still forces cookieless mode unless the site is set to Full. Visitors can also be offered an opt-out. If a site owner uses the identify feature to attach an email or user id to a visitor, that is their decision and their responsibility as controller. Visitors who want to exercise their rights should contact the website they visited; we will help that customer respond.

• Raw events and visit sessions: while the plan is active, up to three years. Hourly and daily totals, which do not identify visitors, are kept while the site exists.
• Session replays: 90 days. Heatmaps: up to three years. Everything is deleted 30 days after a plan ends.
• Visitor identities a site owner attached with the identify feature: until the site owner deletes the site.
• When a site is deleted, its analytics, replays and heatmaps are deleted too. Deleting your account (Account settings) deletes your workspaces where you are the only owner. Deleted data leaves our encrypted backups within 35 days.
• Sign-in records (IP address and browser, kept with each session): until the session expires or you sign out.
• Beta applications that do not become accounts: until the beta ends, or sooner if you ask.

We do not sell personal data, and we do not share it for advertising. We use a small number of service providers who process data for us under contract:

When you connect an integration (for example Stripe, Google Search Console, Slack or Discord), data flows between Statsy and that service because you asked for it; their own privacy terms apply on their side. We may disclose data if the law requires it, and we will push back on requests that are overbroad and tell affected customers where we are allowed to.

Google Search Console: when you connect it, Statsy asks Google for read-only access to the Search Console properties you choose and imports their search queries, clicks, impressions and positions to show them in your dashboard. We do not use this data for advertising, sell it, or let people read it except to support you, for security, or where the law requires. Statsy’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect at any time in your site settings, and the imported data is deleted with your site.

Some providers above operate outside your country. Where data about people in the EEA, UK or Switzerland leaves those regions, we rely on an adequacy decision or on the European Commission’s Standard Contractual Clauses (with the UK addendum where needed), together with the security measures described below.

Traffic is encrypted with TLS. Passwords are hashed, integration secrets are encrypted at rest with AES-256-GCM, API tokens are stored only as hashes, and databases are not reachable from the internet. Sign-in and email endpoints are rate limited, and access inside the product is limited by workspace and role. Backups are encrypted before they leave the server.

No system is perfectly secure. If a breach affects your personal data we will tell you without undue delay. To report a vulnerability, see our security page.

Depending on where you live you can ask to access, correct, export or delete your personal data, to restrict or object to how we use it, and to withdraw consent. Email support@statsy.co and we will reply within 30 days. We may need to confirm it is you first.

If you are in India, you have the rights of a Data Principal under the Digital Personal Data Protection Act, 2023, including to access, correct and erase your data and to have grievances addressed; send grievances to the same address and we will respond within the time the law sets. You can also complain to your data protection authority. We would appreciate the chance to fix things first. Residents of California have the right to know, delete and correct, and we do not sell or share personal information as those laws define it.

Our marketing pages set no tracking cookies. Signing in sets strictly necessary cookies to keep you logged in. The full list, including what the analytics script sets on customer sites, is in our cookie policy.

A few parts of Statsy are built on other people’s work. None of them receive any data about you or your visitors.

• Location lookup. Visitor locations on the live map come from the DB-IP city database, looked up on our own server. The IP address is discarded straight after the lookup.
• Map borders. Country outlines are from Natural Earth, which is in the public domain.
• Visitor avatars. The faces on the live globe are drawn in the browser from random names, never from a real person, using DiceBear and three of its styles: Micah by Micah Lanier (CC BY 4.0), Open Peeps by Pablo Stanley (CC0) and Voxel Art by DiceBear (CC0).

We never train AI models on your data, and we do not allow any provider to. Two optional features send data to an AI model: the weekly digest and the Ask panel, both of which send aggregated totals for a site (visitors, channels, pages, revenue) so a model can write a summary; neither sends anything about an individual visitor. The AI visibility feature asks assistants questions about your brand and stores their answers; it sends only your site name, domain and the terms you track. Our providers are contractually barred from retaining these requests for training.

Statsy is a business tool and is not directed at children under 16. We do not knowingly collect their data as a controller.

If we make a material change we will email account holders at least 14 days before it takes effect and update the date at the top of this page. Earlier versions are available on request.