# Privacy policy

> What personal data Statsy collects on statsy.co and on customer websites, why, how long it is kept, who processes it and your rights.

Canonical page: https://statsy.co/privacy  
Last updated: 23 September 2026

Statsy exists to give website owners useful numbers without tracking people around the web. This policy explains exactly what that means in practice.

## The short version

- For our own customers and statsy.co visitors we are the controller. For visitors to our customers’ websites we are the processor, under the [DPA](https://statsy.co/dpa).
- Visitor IP addresses are used for location lookup and then discarded. They are never stored.
- Cookieless mode stores no identifier in the browser. Auto mode uses it for EU, EEA, UK and Swiss visitors and for Global Privacy Control.
- Raw events, sessions and heatmaps are kept while the plan is active, up to three years. Replays are kept 90 days.
- We do not sell personal data or share it for advertising.
- Questions or requests: <support@statsy.co>. We reply within 30 days.

## 1. Who we are and what this covers

Statsy (https://statsy.co) is a web analytics service (“Statsy”, “we”). This policy explains how we handle personal data in two different situations, because our role is different in each:

- **Our own customers and visitors to statsy.co.** When you join the beta, create an account or use our website, we decide how that data is used. We are the *controller*.
- **Visitors to our customers’ websites.** When a customer installs the Statsy script, we process data about their visitors only on that customer’s instructions. The customer is the controller and we are their *processor*. Our [Data Processing Addendum](https://statsy.co/dpa) sets out those terms.

Questions about privacy: <support@statsy.co>.

## 2. Data we collect about customers

| Data | Why we use it | Legal basis |
| --- | --- | --- |
| Beta applications: email, and optionally name, website, role and a note | To choose who to invite and to email you about the beta | Your consent, which you can withdraw |
| Account details: name, email, password (stored only as a salted hash) | To create and secure your account | Performing our contract with you |
| Workspace data: sites, goals, team members, settings, integration secrets (encrypted) | To provide the service you asked for | Performing our contract |
| Security logs: IP address, browser and time of sign-ins and sensitive actions | To protect accounts, investigate abuse and rate-limit attacks | Our legitimate interest in keeping Statsy secure |
| Emails you send us and support conversations | To answer you and improve Statsy | Legitimate interest |
| Billing details, once paid plans launch | To charge you and keep required records | Contract and legal obligation |

## 3. Data the script collects on customer websites

On a website that uses Statsy, the script sends us:

- The page address and time, the referrer, and campaign parameters (UTM tags and ad click identifiers). Other query parameters only if the site owner turns that on.
- Browser, operating system and device type derived from the user agent, plus screen size, language and time zone.
- Country, region and city, plus the city’s approximate coordinates (rounded to about 1 km), looked up from the IP address with an offline database or our CDN’s location headers. **The IP address itself is not stored.** IP Geolocation by [DB-IP](https://db-ip.com).
- Events the site owner sets up, such as signups, clicks, scroll depth, and payment amounts linked to a visit.
- If the site owner turns them on: session replays, click positions for heatmaps, and page performance timings. Replays mask what visitors type into form fields; other text shown on the page is recorded, so site owners should not enable replays on pages that display sensitive information.

How a visitor is recognised depends on the site’s tracking mode:

- **Cookieless (lightweight).** No cookies and no identifier stored in the visitor’s browser. Visits are grouped on our servers with a key made from a secret that changes every day, the site, the IP address and the browser. The daily secret is deleted after two days, after which no key can be linked back to an IP address or across days. The script caches which mode applies in the tab’s session storage.
- **Full.** A first-party cookie, `statsy_vid`, holds a random identifier for up to one year so returning visits, journeys and revenue can be connected. A session identifier is kept in the tab’s session storage.
- **Auto.** Cookieless for visitors from the EU, EEA, UK and Switzerland and for anyone whose browser sends a Global Privacy Control signal; full for everyone else.

By default the script sends nothing when the browser sends Do Not Track or Global Privacy Control; a site owner can switch that off for their site, in which case Global Privacy Control still forces cookieless mode unless the site is set to Full. Visitors can also be offered an opt-out. If a site owner uses the identify feature to attach an email or user id to a visitor, that is their decision and their responsibility as controller. Visitors who want to exercise their rights should contact the website they visited; we will help that customer respond.

## 4. How long we keep data

- Raw events and visit sessions: while the plan is active, up to three years. Hourly and daily totals, which do not identify visitors, are kept while the site exists.
- Session replays: 90 days. Heatmaps: up to three years. Everything is deleted 30 days after a plan ends.
- Visitor identities a site owner attached with the identify feature: until the site owner deletes the site.
- When a site is deleted, its analytics, replays and heatmaps are deleted too. Deleting your account (Account settings) deletes your workspaces where you are the only owner. Deleted data leaves our encrypted backups within 35 days.
- Sign-in records (IP address and browser, kept with each session): until the session expires or you sign out.
- Beta applications that do not become accounts: until the beta ends, or sooner if you ask.

## 5. Who we share data with

We do not sell personal data, and we do not share it for advertising. We use a small number of service providers who process data for us under contract:

| Provider | What they do | Where |
| --- | --- | --- |
| Vultr | Cloud servers that run Statsy and store its databases | Server region chosen at deployment |
| Cloudflare | DNS, TLS and protection against abusive traffic | Global edge network |
| Email delivery provider | Sending account, alert and report emails | Depends on provider |
| S3-compatible object storage | Database backups, encrypted before upload | Depends on bucket region |
| OpenAI | Writing the optional weekly AI digest from aggregated totals, the site domain and top page paths (no visitor-level data) | United States |

When you connect an integration (for example Stripe, Google Search Console, Slack or Discord), data flows between Statsy and that service because you asked for it; their own privacy terms apply on their side. We may disclose data if the law requires it, and we will push back on requests that are overbroad and tell affected customers where we are allowed to.

Google Search Console: when you connect it, Statsy asks Google for read-only access to the Search Console properties you choose and imports their search queries, clicks, impressions and positions to show them in your dashboard. We do not use this data for advertising, sell it, or let people read it except to support you, for security, or where the law requires. Statsy’s use and transfer of information received from Google APIs adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. You can disconnect at any time in your site settings, and the imported data is deleted with your site.

## 6. International transfers

Some providers above operate outside your country. Where data about people in the EEA, UK or Switzerland leaves those regions, we rely on an adequacy decision or on the European Commission’s Standard Contractual Clauses (with the UK addendum where needed), together with the security measures described below.

## 7. How we protect data

Traffic is encrypted with TLS. Passwords are hashed, integration secrets are encrypted at rest with AES-256-GCM, API tokens are stored only as hashes, and databases are not reachable from the internet. Sign-in and email endpoints are rate limited, and access inside the product is limited by workspace and role. Backups are encrypted before they leave the server.

No system is perfectly secure. If a breach affects your personal data we will tell you without undue delay. To report a vulnerability, see our [security page](https://statsy.co/security).

## 8. Your rights

Depending on where you live you can ask to access, correct, export or delete your personal data, to restrict or object to how we use it, and to withdraw consent. Email <support@statsy.co> and we will reply within 30 days. We may need to confirm it is you first.

If you are in India, you have the rights of a Data Principal under the Digital Personal Data Protection Act, 2023, including to access, correct and erase your data and to have grievances addressed; send grievances to the same address and we will respond within the time the law sets. You can also complain to your data protection authority. We would appreciate the chance to fix things first. Residents of California have the right to know, delete and correct, and we do not sell or share personal information as those laws define it.

## 9. Cookies on statsy.co

Our marketing pages set no tracking cookies. Signing in sets strictly necessary cookies to keep you logged in. The full list, including what the analytics script sets on customer sites, is in our [cookie policy](https://statsy.co/cookies).

## 10. Third-party data and artwork we use

A few parts of Statsy are built on other people’s work. None of them receive any data about you or your visitors.

- **Location lookup.** Visitor locations on the live map come from the [DB-IP](https://db-ip.com) city database, looked up on our own server. The IP address is discarded straight after the lookup.
- **Map borders.** Country outlines are from [Natural Earth](https://www.naturalearthdata.com), which is in the public domain.
- **Visitor avatars.** The faces on the live globe are drawn in the browser from random names, never from a real person, using [DiceBear](https://www.dicebear.com) and three of its styles: [Micah](https://www.dicebear.com/styles/micah/) by Micah Lanier (CC BY 4.0), [Open Peeps](https://www.dicebear.com/styles/open-peeps/) by Pablo Stanley (CC0) and [Voxel Art](https://www.dicebear.com/styles/voxel-art/) by DiceBear (CC0).

## 11. AI features and your data

We never train AI models on your data, and we do not allow any provider to. Two optional features send data to an AI model: the weekly digest and the Ask panel, both of which send aggregated totals for a site (visitors, channels, pages, revenue) so a model can write a summary; neither sends anything about an individual visitor. The AI visibility feature asks assistants questions about your brand and stores their answers; it sends only your site name, domain and the terms you track. Our providers are contractually barred from retaining these requests for training.

## 12. Children

Statsy is a business tool and is not directed at children under 16. We do not knowingly collect their data as a controller.

## 13. Changes to this policy

If we make a material change we will email account holders at least 14 days before it takes effect and update the date at the top of this page. Earlier versions are available on request.

---

Statsy (https://statsy.co) · Contact: support@statsy.co