Changelog

What changed and when. Only things you could notice — not every commit, and no dates rounded to make the gaps look smaller. Adding a subprocessor always appears here.

2026-10-01

• Large CSV exports now stream in smaller pieces, including private historical reports. Export access is still available after a trial or subscription ends.
• Account deletion can continue across multiple billing checks. Subscriptions already cancelled stay cancelled while your data is kept until billing is confirmed stopped. Failed renewals now use the failed billing cycle for their 14-day grace period, so a future renewal date cannot accidentally extend it.
• Our Content Security Policy now blocks inline JavaScript. Inline styles are still allowed. This reduces the risk from injected scripts; it is not a security guarantee.

2026-09-30

• Reopen a report with its dates and metric: bookmark or copy its address. Search loaded pages and sources without changing report totals.
• Fixed timezone keyboard selection, preference failures and the account deletion dialog. Monthly usage keeps the right month even if its reset is late or repeated.
• Promotional emails are paused; service and requested emails are still sent. Our public site adds an opt-out, and privacy notices are clearer.
• Corrections to our privacy pages, none of them in our favour. The privacy policy said DuckDuckGo and jsDelivr are contacted only on an account holder's dashboard, but public dashboards, the demo, the home page and the sign-in page contact them too. Two companies were missing: Apple, which hosts our email, and Better Stack, which runs the status page. Resend processes email in the United States, not only through Amazon SES in Ireland. After you delete your account, billing records are kept by Dodo Payments as the seller, not in our database. simplytics.dev now has its own “Don't count my visits” switch, as we tell other sites to offer, and /health no longer shows the address of the last failed request.
• Public dashboards now create one performance record for each successful unauthenticated view: the time, cache outcome and the time spent resolving access, checking the cache and fetching the report. Cloudflare keeps these per-request records for three months. They contain no site or visitor identifier, domain, URL, IP address, user-agent or cookie. Private dashboards, unavailable pages and visit beacons create no such record. We use them to measure and improve public-dashboard speed; the privacy policy and subprocessor list describe them.
• simplytics.dev counts visitors to its own pages with Simplytics, and the privacy policy did not say so. Until today the counter also ran on signed-in pages, including dashboards, recording addresses such as /analytics/ followed by the domain viewed. It now counts signed-out visits to our marketing, legal, documentation, blog and comparison pages, and a test stops it being added to sign-in or account pages or any analytics dashboard, including the public demo. Those addresses could appear on our public demo; they are now hidden there.

2026-09-29

• Cloudflare no longer makes an automatic log entry for every Simplytics request. Its operational logs remain for three days, and request URLs in the site Worker's logs now omit their query strings, where sign-in, unsubscribe and checkout links can carry tokens or email addresses. Until 2026-09-29 at 15:09 UTC, every request, including each visit beacon, left a three-day log entry. Its request metadata could include an IP address and user-agent. The automatic request-log URL field carried the query string until 2026-09-29 at 14:50 UTC; later automatic entries omitted it. A separate cache-error message could still contain a full public-dashboard URL until 15:09 UTC that day. Billing and account-portal error paths also wrote affected account holders' email addresses into operational logs. The Claude Code production-data guard now also rejects all Workers Logs queries and values and all Cloudflare code-mode calls. The privacy policy, DPA and subprocessors page had not described the logs, and the DPA said nothing was stored at the edge. Those pages now explain the history and current logs. Earlier entries will age out by the end of 2026-10-02 (UTC).

2026-09-26

• Improved outbound-link filtering for percent-encoded names and names changed by character cleanup, and for values matching the existing email-address or credential patterns behind up to two layers of URL encoding. Parameters that pass the filter keep their existing spelling and order, subject to the existing target normalization and length limit. The privacy policy now describes the filter's limits. This filtering applies to link reports recorded after this version was deployed on 2026-09-26. Reports stored before then were filtered by the earlier version and are not re-filtered retroactively.

2026-09-23

• The weekly database backup now runs on Cloudflare instead of a GitHub-hosted machine. Neither the database export nor its temporary download link passes through GitHub any more. The credential GitHub uses for deploys can no longer open the backup storage directly or change the backup job's code, but it can still deploy code that reads the database and, through that code, the backups; the security page says so. Before retiring the old job we loaded one of the new backups into a temporary database and counted its tables and accounts, and every weekly run now does the same. Backups are still kept in private EU-jurisdiction storage and deleted after 90 days. The job that makes them runs on Cloudflare's network, which is not guaranteed to stay in the EU, and the security page says that too. GitHub stays on the subprocessor list: it hosts our code and the operator's working notes, and runs deploys. Those notes include a few account holders' email addresses, written down while fixing their accounts or billing. That was already true and was missing from the list, so this is also a correction.
• Correction: /security, /privacy, /dpa and the Account page said nothing reads or queries our backups except a recovery. Since the weekly backup began on 2026-09-05, the job that writes each export has also checked that it restores. It loads the export into a temporary database, counts its tables and accounts, then deletes that database. The pages now say so. The Account page also said no copy of a deleted account exists anywhere after 90 days. Billing records and our own working notes can outlast that, so it now says the backups stop holding a copy.
• The operator access from India now has a legal safeguard. The DPA incorporates the EU Standard Contractual Clauses (Module 2) and the UK Addendum for it, and publishes our transfer assessment for India. The clauses were not designed for customers outside the EU measuring EU visitors, and the DPA says so. It also names who you are contracting with: Vemu Nikhil, trading as Simplytics, in Kakinada, India. Still missing, and still said so: an EU or UK representative. Subprocessor changes are now emailed to every customer 30 days ahead instead of only published. Two corrections to the subprocessor list, neither in our favour. GitHub runs the weekly backup and was missing; the backup is being moved off it. And the list said “no AI vendor”, but the AI coding assistants the operator uses had read account data while debugging. They are now limited to counts and database or log field names. The Claude Code guard was extended on 2026-09-29 to block request-log event and value queries and all Cloudflare code-mode calls, which it had previously allowed.
• Visitors can be given a switch of their own. Global Privacy Control still stops the script, and a site can now also add a “Don't count my visits” button, which the opt-out page gives site owners to paste. The Privacy Policy no longer says the browser signal alone is what the UK statistics exception asks for, because the ICO says it is not enough.
• Moving a site's past history between accounts is back, with clearer terms. Both sides now see the dates and everything that moves before they agree. The former owner sees the new owner's email only after the new owner asks, and only finished reports move, never raw visit data. A deleted account's ID is replaced on records another account keeps. The homepage proof for claiming a domain must now be a real meta tag in the page head, not the code pasted anywhere on the page.

2026-09-15

• Four corrections, none of them in our favour. We are not the only tool that honours Global Privacy Control. The entry below, dated 8 September, said we were. Two smaller tools honour it by default too — Kobbe and Visitors — and both go further than we do by honouring Do Not Track as well. What is true, and all we will claim from now on, is that none of the eight mainstream trackers we benchmark stops collecting when the signal is set. Custom events and outbound clicks are not uncapped. They still count for nothing against your 50,000 pageviews, which is the part that matters and is a real difference from tools that bill them — but the landing page said “nothing here is capped”, and that was wrong: past five times your plan limit collection pauses, beacons included. Clarified on 2026-09-26 — the limit is shared across all sites on the account, and the hard stop pauses collection for all of them. The pricing FAQ says so plainly. Two competitor script sizes were stale, one of them backwards. We published Plausible at ~2.5 KB and Fathom at under 2 KB, and both were wrong: re-measured on 8 September they are 1.3 KB and 2.1 KB, which makes Plausible’s base script smaller than ours, not larger. The comparison pages and the homepage table now carry the measured numbers, and we say which of them we measured ourselves. We also said Simple Analytics has no funnels; it has goals with multi-step filters, and that row is corrected. And we have stopped calling ourselves “GDPR compliant”. It was in the share card and the search-result description of nearly every page, while the Privacy Policy named the things we do not have — no EU or UK representative, no postal address, no documented safeguard for India-based access to customer visitor data. Both cannot be true. Correction (18 September): those replacement descriptions were still too categorical. We set no visitor cookies, but a short-lived daily hash and some text dimensions may be personal data. Consent and transfer duties need a site-specific assessment; the page descriptions now state the technical facts without promising a legal exemption.

2026-09-08

• We now say where we are. The Privacy Policy, About, Security and Subprocessors pages all now state that Simplytics is run by one person based in India, and that administering the service means reading the EU-hosted database from there. Nothing about where your data lives has changed — the database is still in the EU (Warsaw). What changed is that we were not telling you the one thing you would need to complete your own records, because an EU controller giving an India-based processor remote access to personal data can be a restricted transfer despite EU hosting. The Privacy Policy also says which safeguards are not yet in place, rather than leaving you to assume.
• The Privacy Policy now answers the questions the GDPR actually asks. Four new sections: why we are allowed to hold each kind of data, with the lawful basis named per purpose rather than one blanket claim for the page; how long each kind is kept, from raw visit rows deleted nightly to the 90-day outer edge that backups put on everything; your rights and how to use them, most of them without asking us at all; and plainly, who to complain to about us — the ICO in the UK, your national authority in the EU — with a note that you need not raise it with us first. It also states what is still missing rather than papering over it: there is no postal address, no EU or UK representative and no data protection officer, and we would rather name those gaps than print something plausible in their place.
• Visitors can now switch tracking off themselves, and none of the mainstream tools we compare against does this. If a visitor's browser sends Global Privacy Control — Brave and DuckDuckGo send it for everyone, Firefox has a checkbox — the script now sends nothing at all. Not a reduced record: it stops before making any request. There is a new opt-out page explaining it, linked from the footer of every page. This will reduce your numbers, and we would rather you heard it here than noticed it in a chart: expect low single digits for a general audience, more if your readers are developers. If that is not a trade you want to make, the snippet accepts data-honor-gpc="false" and counts everyone as before. We fetched the trackers of Plausible, Fathom, Simple Analytics, Umami, Pirsch, GoatCounter, Matomo and Google Analytics when this shipped and re-checked them on 2026-09-09: none of the eight stops collecting when the signal is set. Two smaller tools do honour it — Kobbe and Visitors — and this entry claimed to be the only one until we corrected it on 2026-09-15. Against the eight we benchmark, the comparison is not like-for-like any more, and that is a deliberate choice rather than an oversight.
• One switch that stops all marketing email. Every onboarding or reminder email now carries two unsubscribe links: the one it always had, which stops just that kind, and a new one that stops all marketing from us — product news, tips, onboarding, reminders. There is a matching checkbox on your account page. Neither needs you to sign in, and neither expires. What it deliberately does not touch: sign-in links, anything about your subscription such as a failed payment, a notice that your tracking has passed its monthly limit, and the weekly digest and spike alerts you switched on yourself — those are reports you asked for rather than us selling to you, and they have their own toggles. Australian and New Zealand law require the single global opt-out specifically; per-type unsubscribes do not satisfy it on their own. Updated on 2026-09-16 — the quota notice did not exist when this shipped on 8 September, and this sentence is a list of what the switch leaves running, so it is named here rather than left to be discovered in an inbox.
• A correction about deletion, and it is not in our favour. Several pages said you could delete your account and “every byte” of its data. That was not true, and we would rather say so than quietly reword it. We also said deletion always cleared the live database immediately. A later audit found missing live rows and a billing gap, corrected on 2026-09-16. A successful deletion now clears the account and analytics immediately, but two disaster-recovery backups outlive it: a rolling point-in-time window Cloudflare keeps (at most 30 days), and a whole-database export written weekly to private EU storage, which is deleted 90 days after it is written. Neither is ever read by any feature; they exist so that a catastrophe is survivable. The account and analytics copies in those backups age out within 90 days. Billing records and an address-level email suppression record can remain, as Privacy explains. Security, the DPA, Terms, About and the Account page describe the deletion limits too.
• Clearer terms. The Terms no longer say the service is provided without warranty of any kind, and they now state plainly that nothing in them takes away a consumer right you have under a law that cannot be contracted out of — the Australian Consumer Law and the New Zealand Consumer Guarantees Act are named alongside the EU and UK rights that were already there. We also stopped treating your continued use as agreement to a change: a change that would reduce what you get is emailed to you 30 days beforehand, and you can leave and get the unused part back.

2026-09-06

• A public status page, linked from the footer of every page. An independent monitor checks the site every three minutes and the page is hosted outside our infrastructure, so it stays up when Simplytics does not — which is the only time it matters.

2026-09-05

• Sign in with a link emailed to you — no Google or GitHub account needed. Google is now asked for your verified email address without the profile scope that used to ask for a name and picture we never used. We also use the provider account ID to keep your Simplytics account linked if that address changes.
• The setup card now says where the snippet goes on twelve platforms, tells you the trial has not started yet, and explains the four things that usually stop data arriving. It can also email you the snippet. Corrected on 2026-09-26 — that trial message was too broad: setup cards and snippet emails now use the account's trial or access state. Adding a site does not restart the account trial.
• Onboarding and reminder emails, each with its own unsubscribe. Billing notices are exempt and say so.
• When a trial ends we keep counting for another seven days, so subscribing inside that week leaves no gap in your history.

2026-09-04

• The dashboard works on a phone.
• The tracking script got smaller, and stopped counting things it should never have counted.
• Funnels are scoped to the account that owns them.
• Weekly database backups to private EU storage, and a health check that reports a real failure instead of always answering "ok".

2026-09-03

• A failed payment no longer cuts you off immediately: access continues while the card is retried.

2026-06-14

• Outbound-link tracking keeps the query string, so affiliate and campaign parameters survive.

2026-06-12

• Traffic-spike alerts and the weekly digest became separate opt-ins, and spike alerts stopped repeating themselves for the same spike.
• Single-page apps are tracked without any extra code.
• Compare any period against the one before it.
• A country map on the dashboard.
• Volume caps removed — pageviews are never dropped or rejected at the limit, though there is one hard stop above it: five times your plan limit, 250,000 pageviews on the standard plan, past which collection pauses. Clarified on 2026-09-26 — the counter is shared across all sites on the account, so collection pauses for all sites on the account. Corrected on 2026-09-16 — “removed” was too strong, and this entry had said it plainly since June. Nothing is dropped at your limit, which is what it meant and what still holds. The pricing FAQ and the entry for 15 September say the same.

What is coming next is on the roadmap, without dates.

Anything older than this predates the current owner. Simplytics was acquired in January 2026 and rebuilt; dating changes from before then would be claiming work that is not ours.