Changelog

Changes you could notice, dated the day they shipped. A new subprocessor always appears here.

2026-10-20

• Simplytics keeps no Cloudflare Workers Logs from 2026-10-20. Logs from before then expire by 2026-10-23.

2026-10-11

• When we verify a backup, we keep only table names, checksums, sizes and counts, never values from customer rows. No older backup is read.

2026-10-01

• Large CSV exports, including private historical reports, now download in smaller pieces. You can still export after a trial or subscription ends.
• Account deletion can now take more than one billing check. Cancelled subscriptions stay cancelled, and your data is kept until billing is confirmed stopped.
• The 14-day grace period after a failed renewal now counts from the failed billing cycle, so a later renewal date cannot extend it.
• Our Content Security Policy now blocks inline JavaScript; inline styles are still allowed. This reduces the risk from injected scripts.

2026-09-30

• Bookmark or copy a report's address to reopen it with the same dates and metric. Search the loaded pages and sources without changing report totals.
• Fixed choosing a timezone by keyboard, settings that failed to save, and the account deletion dialog. Monthly usage stays in the right month even if its reset runs late or twice.
• Promotional emails are paused; service emails and emails you asked for are still sent. simplytics.dev now has an opt-out, and our privacy notices are clearer.
• Fixed: our privacy pages now say DuckDuckGo and jsDelivr are contacted from public dashboards, the demo, the home page and the sign-in page, not only from your own dashboard. They now list Apple (our email host) and Better Stack (the status page), and say Resend also processes email in the United States, not only through Amazon SES in Ireland.
• After you delete your account, Dodo Payments keeps the billing records as the seller; they are not in our database. simplytics.dev now has its own “Don't count my visits” switch, and /health no longer shows the address of the last failed request.
• Each successful signed-out view of a public dashboard now creates one performance record: the time, the cache result and how long each step took. Cloudflare keeps these for three months; they hold no site or visitor identifier, domain, URL, IP address, user-agent or cookie.
• Private dashboards, unavailable pages and visit beacons create no such record. We use them to measure and improve public-dashboard speed; the privacy policy and subprocessor list describe them.
• simplytics.dev counts its own visitors with Simplytics, and the privacy policy did not say so. Until today it also counted signed-in pages, including dashboards, recording addresses such as /analytics/ followed by the domain viewed, which could appear on our public demo.
• It now counts only signed-out visits to our marketing, legal, documentation, blog and comparison pages, never sign-in, account or dashboard pages, and those addresses are hidden on the demo.

2026-09-29

• Cloudflare no longer makes an automatic log entry for every Simplytics request. Its operational logs are kept for three days, and request URLs in our logs now omit query strings, which in sign-in, unsubscribe and checkout links can carry tokens or email addresses.
• Until 2026-09-29 at 15:09 UTC, every request, including each visit beacon, left a three-day log entry whose metadata could include an IP address and user-agent. The automatic entries kept the query string until 14:50 UTC that day, and a cache-error message could hold a full public-dashboard URL until 15:09 UTC.
• Billing and account-portal errors also wrote affected account holders' email addresses into these logs. The privacy policy, DPA and subprocessors page had not described the logs, and the DPA said nothing was stored at the edge; they now explain the history and the current logs, and earlier entries age out by the end of 2026-10-02 (UTC).
• The production-data guard on the Claude Code assistant now also rejects all Workers Logs queries and values and all Cloudflare code-mode calls.

2026-09-26

• Improved outbound-link filtering for percent-encoded names and names changed by character cleanup, and for values matching the existing email-address or credential patterns behind up to two layers of URL encoding. Parameters that pass the filter keep their existing spelling and order, subject to the existing target normalization and length limit. The privacy policy now describes the filter's limits. This filtering applies to link reports recorded after this version was deployed on 2026-09-26. Reports stored before then were filtered by the earlier version and are not re-filtered retroactively.

2026-09-23

• The weekly database backup now runs on Cloudflare instead of a GitHub-hosted machine, so neither the export nor its temporary download link passes through GitHub. GitHub's deploy credential can no longer open the backup storage directly or change the backup job's code, but it can still deploy code that reads the database and, through that code, the backups, as the security page says.
• Every weekly run now loads the new backup into a temporary database and counts its tables and accounts. Backups stay in private EU-jurisdiction storage and are deleted after 90 days, but the job runs on Cloudflare's network, which is not guaranteed to stay in the EU.
• GitHub stays on the subprocessor list because it hosts our code and the operator's working notes and runs deploys. The list now says those notes include a few account holders' email addresses, written down while fixing their accounts or billing.
• Fixed: /security, /privacy, /dpa and the Account page now say that since the weekly backup began on 2026-09-05, each run has loaded its export into a temporary database, counted its tables and accounts, then deleted that database.
• The Account page now says the backups stop holding a copy of a deleted account after 90 days. Billing records and our own working notes can outlast that.
• Operator access from India now has a legal safeguard: the DPA incorporates the EU Standard Contractual Clauses (Module 2) and the UK Addendum, and publishes our transfer assessment for India. The DPA says the clauses were not designed for customers outside the EU measuring EU visitors, names who you contract with (Vemu Nikhil, trading as Simplytics, in Kakinada, India), and says we still have no EU or UK representative.
• Subprocessor changes are now emailed to every customer 30 days ahead, not only published. The subprocessor list now names GitHub, which ran the weekly backup, and says the AI coding assistants the operator uses had read account data while debugging.
• Those assistants are now limited to counts and database or log field names. On 2026-09-29 the Claude Code guard was extended to block request-log event and value queries and all Cloudflare code-mode calls, which it had previously allowed.
• Sites can now add a “Don't count my visits” button; the opt-out page has the code to paste. Global Privacy Control still stops the script, but the Privacy Policy no longer says the browser signal alone is what the UK statistics exception asks for, because the ICO says it is not enough.
• Moving a site's past reports to its new owner is back: both sides see the dates and what moves before they agree, and only finished reports move, never raw visit data. The former owner sees the new owner's email only after the new owner asks.
• A deleted account's ID is now replaced on records another account keeps. To claim a domain from its homepage, the code must now be a real meta tag in the page head, not pasted anywhere on the page.

2026-09-15

• Fixed: the 8 September entry now names Kobbe and Visitors, which also honour Global Privacy Control by default, and Do Not Track as well. None of the eight mainstream trackers we benchmark stops collecting when the signal is set.
• Fixed: custom events and outbound clicks still add nothing to your 50,000 pageviews, and the landing page now says that past five times your plan limit collection pauses, beacons included. Clarified on 2026-09-26: the limit is shared across all sites on the account, and the hard stop pauses collection for all of them, as the pricing FAQ says.
• Fixed: the comparison pages and homepage table now show competitor script sizes re-measured on 8 September: Plausible is 1.3 KB, so its base script is smaller than ours, and Fathom is 2.1 KB. They also now say Simple Analytics has funnels: goals with multi-step filters.
• We stopped calling ourselves “GDPR compliant” in the share card and search description of nearly every page, because the Privacy Policy names what we lack: an EU or UK representative, a postal address, and a documented safeguard for India-based access to customer visitor data. Updated 18 September: the descriptions now state only technical facts, because a short-lived daily hash and some text dimensions may be personal data.

2026-09-08

• The Privacy Policy, About, Security and Subprocessors pages now say Simplytics is run by one person based in India, who administers the EU-hosted database (Warsaw) from there. That remote access can be a restricted transfer for an EU controller, and the Privacy Policy says which safeguards are not yet in place.
• The Privacy Policy now names the lawful basis for each kind of data, how long each is kept, your rights, and who to complain to: the ICO in the UK or your national authority in the EU, and you need not raise it with us first. It also says what is missing: no postal address, no EU or UK representative and no data protection officer.
• If a visitor's browser sends Global Privacy Control (Brave and DuckDuckGo do for everyone; Firefox has a checkbox), the script now sends nothing at all, and the new opt-out page, linked from every footer, explains it. This will reduce your numbers, by low single digits for a general audience and more for developers; add data-honor-gpc="false" to the snippet to count everyone as before.
• We checked Plausible, Fathom, Simple Analytics, Umami, Pirsch, GoatCounter, Matomo and Google Analytics when this shipped and again on 2026-09-09, and none of the eight stops collecting when the signal is set. Two smaller tools, Kobbe and Visitors, do.
• Every onboarding or reminder email now has a second unsubscribe link that stops all marketing from us, with a matching checkbox on your account page; neither needs a sign-in or expires. It does not stop sign-in links, subscription notices such as a failed payment, the notice that tracking passed its monthly limit (added here on 2026-09-16), or the weekly digest and spike alerts, which have their own toggles.
• Fixed: pages now say a successful deletion clears the account and analytics from the live database immediately (missing live rows and a billing gap were fixed on 2026-09-16), but copies stay in backups for up to 90 days: Cloudflare's point-in-time window (at most 30 days) and a weekly export to private EU storage, deleted 90 days after it is written.
• Billing records and an address-level email suppression record can remain, as Privacy explains. Security, the DPA, Terms, About and the Account page describe these limits too.
• The Terms no longer say the service comes without any warranty, and they now say nothing in them removes a consumer right you cannot contract out of, naming the Australian Consumer Law and New Zealand Consumer Guarantees Act alongside EU and UK rights. Continued use no longer counts as agreeing to a change: a change that reduces what you get is emailed 30 days ahead, and you can leave and get the unused part back.

2026-09-06

• A public status page, linked from every footer. An independent monitor checks the site every three minutes, and the page is hosted outside our infrastructure, so it stays up when Simplytics is down.

2026-09-05

• Sign in with a link emailed to you, no Google or GitHub account needed. Google sign-in no longer asks for the name and picture we never used, just your verified email address, and we use the provider account ID to keep your account linked if that address changes.
• The setup card now shows where the snippet goes on twelve platforms, explains the four things that usually stop data arriving, and can email you the snippet. Updated 2026-09-26: setup cards and snippet emails now use your account's trial or access state, and adding a site does not restart the trial.
• Onboarding and reminder emails, each with its own unsubscribe. Billing notices are exempt and say so.
• When a trial ends we keep counting for seven more days, so subscribing that week leaves no gap in your history.

2026-09-04

• The dashboard works on a phone.
• The tracking script got smaller, and stopped counting things it should never have counted.
• Funnels are scoped to the account that owns them.
• Weekly database backups to private EU storage, and a health check that reports a real failure instead of always answering "ok".

2026-09-03

• A failed payment no longer cuts you off immediately: access continues while the card is retried.

2026-06-14

• Outbound-link tracking keeps the query string, so affiliate and campaign parameters survive.

2026-06-12

• Traffic-spike alerts and the weekly digest became separate opt-ins, and spike alerts stopped repeating themselves for the same spike.
• Single-page apps are tracked without any extra code.
• Compare any period against the one before it.
• A country map on the dashboard.
• Pageviews are never dropped or rejected at your plan limit. There is one hard stop: past five times your plan limit, 250,000 pageviews on the standard plan, collection pauses. Clarified on 2026-09-26: the limit is shared across the account, so collection pauses for all sites on the account.

What is coming next is on the roadmap, without dates.

Older changes predate the current owner: Simplytics was acquired in January 2026 and rebuilt.