AbsolutelyAnalytics
Start 30-day trial

Data policy

What we collect, and what we cannot

Written to be read rather than survived. Everything below describes what the software actually does, and you can check the important parts against the script we serve to your visitors.

Last updated 5 September 2026

Never collected

  • IP addresses — not in a log, a database, or an object store
  • Cookies of any kind
  • Names, emails or any visitor identifier
  • Cross-site or cross-day tracking identifiers
  • Fingerprints — no canvas, audio, font or WebGL probing
  • Precise location — country and region only
  • Keystrokes, clipboard contents or file names
  • Form field contents, including in session replay

Collected from your visitors

  • The page URL, with the query string dropped unless it is a UTM parameter
  • The referrer, reduced to its hostname
  • Country and region, derived at the edge and never stored with an IP
  • Browser, operating system and device class, parsed from the user agent
  • Screen size bucket — mobile, tablet or desktop
  • A daily visitor token, described below
  • Any custom events you choose to send

The identifier

The one identifier we do create, and how it dies

To tell one visitor from two we need something. This is the smallest possible something, and it destroys itself every night.

01 Seen in memory, for one request

  • IP address 203.0.113.42 local variable, one request
  • User agent Mozilla/5.0 (Macintosh… never stored raw

02 One-way function

One‑way hash Not reversible. Not a lookup.

03 All we keep

The day's token 9f3a71c4e0b58d2a6c81d4f7

An opaque token, scoped to one site for one day. Nothing links it to a person, to a device, to the same visitor tomorrow, or to the same person on another site running this product.

04 Discarded before the response

  • 203.0.113.42never written
  • Mozilla/5.0 (Macintosh…parsed, then dropped

No IP address reaches a log, a database, an analytics pipeline or an object store. It exists as one local variable and goes out of scope with the request.

Every day, yesterday becomes unrecoverable

Tokens rotate daily, and the previous day's cannot be recomputed — not by us, not by anyone who obtained the database, not under a court order. So yesterday's visitors cannot be joined to today's. Cross-day tracking here is not switched off by policy; it is arithmetically impossible, which is the only kind of promise worth making.

Diagram: a visitor's IP address and user agent are seen only in memory during a single request and are discarded before the response is sent, never written to storage. What is kept is an opaque one-way token, scoped to one site for one day. The token rotates daily and the previous day's cannot be recomputed, so visitors cannot be linked across days, and it cannot be linked to the same person on any other site.

What we collect about you, the customer

Your email address, a hashed password (or nothing at all, if you use a magic link), your chosen jurisdiction, and the sites you have added. If you are on a paid plan, Stripe holds your billing details — we store only a customer reference, the last four digits of the card and the country, so we can show them on your invoices.

We keep an audit log of security-relevant actions on your own account: sign-ins, API key creation, site deletion and plan changes. Each entry records the action, the time and a coarse location. It does not record an IP address.

Where your data lives

You pick a jurisdiction when you create your account — EU, UK, Switzerland, Canada, Australia or the United States — and the event store for your sites is created inside it. This is a hard constraint rather than a preference: it is enforced below us and cannot be changed afterwards, which is why we make you choose up front instead of offering it as a toggle you might flip later.

Archived events are written to object storage in the same jurisdiction. Backups do not leave it. A signed data processing agreement naming your jurisdiction is part of an Enterprise agreement; there is no self-serve add-on that sells it.

How long we keep things

  • Aggregated statistics: 15 months on every plan. A locked account — a trial that ended, or a cancelled subscription — stops being able to read its statistics; they are not deleted, and paying again restores them.
  • Raw event records: 12 months, then aggregated and the raw rows dropped. Shorter than the window your statistics are readable for, deliberately: the aggregates answer the questions, and an individual event row stops being worth keeping long before the count it contributed to does.
  • Session replay recordings: 30 days by default, configurable down to 24 hours.
  • The visitor hash: it is one-way, and the input that makes it reproducible is destroyed daily and never archived. Yesterday's hashes cannot be recomputed, which is why they cannot be joined to today's.
  • Account audit log: 24 months.
  • Invoices: as long as tax law requires, then deleted.

The ePrivacy Directive requires consent to store or access information on a visitor's device. We store nothing and read nothing — no cookies, no localStorage, no sessionStorage, no cache probing. The only exception is the opt-out flag, which a visitor sets deliberately and which is expressly permitted.

The GDPR requires a lawful basis for processing personal data. The daily token is not reasonably capable of identifying anyone: it is one-way, the signals that produced it are destroyed within the request, it rotates daily and cannot be recomputed for a past day, and it is scoped to a single site. We nevertheless treat this as pseudonymised data and apply the same controls we would if it were not.

Session replay is different, and we will not pretend otherwise. A recording of one person's visit is personal data in most regulators' view, even with every field masked. If you enable replay, gate it behind consent — our recorder ships with the hook to do exactly that, and does not record until you call it.

The full reasoning — Article 5(3) against Article 4(1), why "we anonymise the IP" settles less than it sounds, and what the 2022 regulator decisions do and do not still mean — is in what makes web analytics GDPR-compliant.

Your visitors' rights

A subject access request is an awkward thing to answer when you hold no identifiers. If one of your visitors asks what you have on them, the answer is: a count they contributed to, and nothing that can be traced back to them. There is no record to retrieve, correct or port, because there is no key to look one up by.

Erasure is the same. There is nothing individual to erase — which is the intended outcome, not an evasion.

This website

absolutelyanalytics.com runs Absolutely Analytics on itself, under exactly the policy above. There are no third-party scripts, no advertising pixels, no chat widget and no A/B testing tool. Fonts are served by Google Fonts, which sees a request for the font file; if that matters to you, tell us and we will self-host them.

Changes

If we change this policy in a way that widens what we collect, we will email every account holder before it takes effect, not after. Cosmetic changes get a new date at the top and nothing more.

Contact

Write to hello@absolutelyanalytics.com. A person answers.

Questions

Privacy questions

Do you sell or share data with anyone?

No. We have no advertising business, no data partnerships and no third-party trackers on this site. Our revenue is subscriptions, in full.

Who are your sub-processors?

Cloudflare, for compute, storage and transactional email, and Stripe for payments. That is the complete list. Stripe receives your account and billing details as a customer; it never receives your visitors' data, and neither does any other third party.

How do I delete everything?

Delete a site from your dashboard and its events are removed within 24 hours, including from backups on their next rotation. Close your account and everything goes, including your billing record beyond what tax law requires us to retain. Or email hello@absolutelyanalytics.com and we will do it.

Can a visitor opt out?

Yes. A visitor can set localStorage.setItem("aa-optout", "1") on your domain and our script stops sending anything at all. We honour Global Privacy Control automatically. This is the only thing we ever write to a visitor's browser.

Will you hand data to law enforcement?

We would comply with a valid, binding order in a jurisdiction that applies to us. The useful part is what we could hand over: no IP addresses, no cookies, no cross-day identifiers and no names. There is very little to give.

Read next

Measuring without cookies