Data policy
What we collect, and what we cannot
This page is not a legal instrument written to be unreadable. It is a description of what the software does, which you can verify against the tracker source.
Last updated 5 September 2026
Never collected
- IP addresses — not in a log, a database, or an object store
- Cookies of any kind
- Names, emails or any visitor identifier
- Cross-site or cross-day tracking identifiers
- Fingerprints — no canvas, audio, font or WebGL probing
- Precise location — country and region only
- Keystrokes, clipboard contents or file names
- Form field contents, including in session replay
Collected from your visitors
- The page URL, with the query string dropped unless it is a UTM parameter
- The referrer, reduced to its hostname
- Country and region, derived at the edge and never stored with an IP
- Browser, operating system and device class, parsed from the user agent
- Screen size bucket — mobile, tablet or desktop
- A daily visitor token, described below
- Any custom events you choose to send
The identifier
The one identifier we do create, and how it dies
To tell one visitor from two we need something. This is the smallest possible something, and it destroys itself every night.
01 Seen in memory, for one request
- IP address
203.0.113.42local variable, one request - User agent
Mozilla/5.0 (Macintosh…never stored raw
02 One-way function
03 All we keep
9f3a71c4e0b58d2a6c81d4f7 An opaque token, scoped to one site for one day. Nothing links it to a person, to a device, to the same visitor tomorrow, or to the same person on another site running this product.
04 Discarded before the response
203.0.113.42never writtenMozilla/5.0 (Macintosh…parsed, then dropped
No IP address reaches a log, a database, an analytics pipeline or an object store. It exists as one local variable and goes out of scope with the request.
Every day, yesterday becomes unrecoverable
Tokens rotate daily, and the previous day's cannot be recomputed — not by us, not by anyone who obtained the database, not under a court order. So yesterday's visitors cannot be joined to today's. Cross-day tracking here is not switched off by policy; it is arithmetically impossible, which is the only kind of promise worth making.
What we collect about you, the customer
Your email address, a hashed password (or nothing at all, if you use a magic link), your chosen jurisdiction, and the sites you have added. If you are on a paid plan, Stripe holds your billing details — we store only a customer reference, the last four digits of the card and the country, so we can show them on your invoices.
We keep an audit log of security-relevant actions on your own account: sign-ins, API key creation, site deletion and plan changes. Each entry records the action, the time and a coarse location. It does not record an IP address.
Where your data lives
Everything runs on Cloudflare. You pick a jurisdiction when you create your account — EU, UK, Switzerland, Canada, Australia or the United States — and the event store for your sites is pinned to it. This is a jurisdiction constraint, not a location hint: it is enforced by the platform and cannot be changed after creation, which is precisely why we make you choose up front rather than offering it as a toggle later.
Archived events are written to object storage in the same jurisdiction. Backups do not leave it. A signed data processing agreement naming your jurisdiction is part of an Enterprise agreement; there is no self-serve add-on that sells it.
How long we keep things
- Aggregated statistics: 3 years starter and growth · 5 years business. A locked account — a trial that ended, or a cancelled subscription — stops being able to read its statistics; they are not deleted, and paying again restores them.
- Raw event records: 12 months, then aggregated and the raw rows dropped.
- Session replay recordings: 30 days by default, configurable down to 24 hours.
- The visitor hash: it is one-way, and the input that makes it reproducible is destroyed daily and never archived. Yesterday's hashes cannot be recomputed, which is why they cannot be joined to today's.
- Account audit log: 24 months.
- Invoices: as long as tax law requires, then deleted.
Why you do not need a cookie banner
The ePrivacy Directive requires consent to store or access information on a visitor's
device. We store nothing and read nothing — no cookies, no localStorage, no
sessionStorage, no cache probing. The only exception is the opt-out flag,
which a visitor sets deliberately and which is expressly permitted.
The GDPR requires a lawful basis for processing personal data. The daily token is not reasonably capable of identifying anyone: it is one-way, the signals that produced it are destroyed within the request, it rotates daily and cannot be recomputed for a past day, and it is scoped to a single site. We nevertheless treat this as pseudonymised data and apply the same controls we would if it were not.
Session replay is different, and we will not pretend otherwise. A recording of one person's visit is personal data in most regulators' view, even with every field masked. If you enable replay, gate it behind consent — our recorder ships with the hook to do exactly that, and does not record until you call it.
Your visitors' rights
A subject access request is an awkward thing to answer when you hold no identifiers, and we would rather say that plainly than imply a capability we lack. If one of your visitors asks you what you hold about them, the honest answer is: a count they contributed to, and nothing that can be traced back to them. There is no record to retrieve, correct or port, because there is no key to look it up by.
Erasure is the same. There is nothing individual to erase — which is the intended outcome, not an evasion.
This website
absolutelyanalytics.com runs Absolutely Analytics on itself, under exactly the policy above. There are no third-party scripts, no advertising pixels, no chat widget and no A/B testing tool. Fonts are served by Google Fonts, which sees a request for the font file; if that matters to you, tell us and we will self-host them.
Changes
If we change this policy in a way that widens what we collect, we will email every account holder before it takes effect, not after. Cosmetic changes get a new date at the top and nothing more.
Contact
Write to hello@absolutelyanalytics.com. A person answers.
Questions
Privacy questions
Do you sell or share data with anyone?
No. We have no advertising business, no data partnerships and no third-party trackers on this site. Our revenue is subscriptions, in full.
Who are your sub-processors?
Cloudflare for all compute and storage, Stripe for payments, and Postmark for transactional email. That is the complete list. Stripe and Postmark receive your account details as a customer; neither ever receives your visitors' data.
How do I delete everything?
Delete a site from your dashboard and its events are removed within 24 hours, including from backups on their next rotation. Close your account and everything goes, including your billing record beyond what tax law requires us to retain. Or email hello@absolutelyanalytics.com and we will do it.
Can a visitor opt out?
Yes. A visitor can set localStorage.setItem("aa-optout", "1") on your domain and our script stops sending anything at all. We honour Global Privacy Control automatically. This is the only thing we ever write to a visitor's browser.
Will you hand data to law enforcement?
We would comply with a valid, binding order in a jurisdiction that applies to us. The useful part is what we could hand over: no IP addresses, no cookies, no cross-day identifiers and no names. There is very little to give.