Privacy Policy

1. Who is responsible for this data?

SiteStats.dev ("we", "us", "our") is operated by an independent team of developers and is the data controller for any personal information processed under this policy. You can reach us at support@sitestats.dev.

2. What data do we collect about you?

We distinguish between account data (about you, the SiteStats.dev customer) and analytics data (about visitors to your tracked sites).

2.1 Account data

• Your name and email address (provided at sign-up)
• A bcrypt-hashed password (we never see your plain-text password)
• Billing information processed by Stripe — we do not store full card numbers; only the Stripe customer and subscription IDs
• Server logs containing your IP address for security purposes (retained for 14 days)

2.2 Analytics data (about your site's visitors)

• Page URL visited and the referring URL
• Country and (when available) city, derived from IP at the moment of the request — the IP itself is discarded immediately and never stored
• Device class (desktop / mobile / tablet), browser, and operating system
• A short-lived session identifier stored in sessionStorage on the visitor's device — never in cookies, never tied to a person
• Approximate session duration in seconds

We do not collect names, email addresses, IP addresses (post-lookup), browser fingerprints, mouse-movement traces, or any other PII about your visitors.

3. Why do we collect this data?

• To provide aggregate traffic analytics for the websites you ask us to track
• To bill, support, and authenticate your account
• To detect and block abuse and fraud
• To send you account-related and (if you opt-in) product update emails

4. Do you use cookies?

The tracker we ship to your website does not set cookies. Within the SiteStats.dev application itself (this site), we use a single first-party session cookie that is required to keep you logged in. We do not use advertising or third-party analytics cookies on our own site.

5. How long do we retain data?

Account data is retained for as long as you have an active account, plus a short period after closure for legal and accounting purposes. Analytics data follows the retention defined by your plan (30 days on Free, 12 months on Pro, 24 months on Agency). After that, individual rows are pruned and only daily aggregates remain.

6. Do you share my data with anyone?

We do not sell your data. We share data with the following processors strictly for the purpose of running the service: Stripe (payments), our SMTP provider (transactional email), and our VPS provider (hosting). Each processor is bound by GDPR-aligned data-processing agreements.

7. What rights do I have?

If you are in the EU, EEA, UK, California, or another jurisdiction with data-protection laws, you have the right to access, correct, port, restrict, or delete the personal data we hold about you. You can exercise any of these rights from your account settings or by emailing support@sitestats.dev. We will respond within 30 days.

8. Is the service GDPR / CCPA / PECR compliant?

Yes. Because the SiteStats.dev tracker does not use cookies, does not fingerprint, and does not store PII about your visitors, sites that use SiteStats.dev typically do not need a cookie consent banner under GDPR or PECR. CCPA's "do not sell" requirement is satisfied by default — we never sell data, period.

9. How do you secure my data?

All traffic is served over HTTPS with modern TLS. Passwords are hashed with bcrypt at a strong cost factor. Database queries use parameterized statements exclusively. Sessions use HttpOnly, Secure, SameSite=Strict cookies. We perform regular off-site backups encrypted at rest.

10. Will this policy change?

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, for material changes, notify you by email. Continued use of the service after a change constitutes acceptance.

11. How do I contact you about privacy?

Email support@sitestats.dev. We answer privacy enquiries personally and quickly.