Privacy Policy

Simplytics is built so that we know as little as possible about the people who visit the websites we track. This page explains exactly what we collect and what happens to it.

Visitors of websites that use Simplytics

• No cookies. Our tracking script sets no cookies and stores nothing in your browser.
• What is sent: the page you viewed, the referring site, a timestamp, and any utm_* campaign parameters on the link. If the site uses custom events, an event's name is sent when you trigger it. A short "still reading" ping carries how long the tab has been active. Clicking a link to another site, or to a downloadable file, sends that link's address, including its query string. Before storage, we remove query parameters with known sensitive names, such as email, password, token and session, including spellings we recognise after decoding and character cleanup. We also remove values that match email-address or long credential patterns. This reduces accidental collection; it is a list of known names and patterns rather than a guarantee that paths or other free-form values contain no personal data. This filtering applies to link reports recorded after this version was deployed on 2026-09-26. Reports stored before then were filtered by the earlier version and are not re-filtered retroactively.
• Coarse location and device stats: at the network edge we read a two-letter country code provided by Cloudflare and derive a device class (desktop, mobile, tablet) and browser family from the user-agent. The analytics database keeps only daily counts of these; it does not store the user-agent or IP address themselves. Until 2026-09-29 at 15:09 UTC, Cloudflare's three-day request logs also recorded visit-request metadata that could include your IP address and user-agent. Failed requests from before 2026-10-20 can appear in operational logs; see Operational logs below.
• Bot checks: the script sends nothing from a browser that reports it is automated, and we refuse visit requests without the Origin header browsers send. At the network edge we also read which network a request comes from (its number, provided by Cloudflare), to count visits from cloud and hosting providers and to spot attacks on a site. We keep a daily count of those per site for 90 days and, for the attack check, daily counts per site per cloud provider for 15 days. Visit requests whose headers no browser sends, such as an empty user-agent, are still recorded; we keep only a daily count of them per site, for 90 days.
• How visitors are counted: a keyed daily hash of a truncated IP address (last part removed), the browser's user-agent, the website's domain and its local date. It recognises repeat visits to the same site that day, changes across sites and days, and is deleted with the raw visit rows. While stored, it may be personal data.
• You can refuse to be counted at all. Turn on Global Privacy Control in your browser and the Simplytics script sends nothing: it stops before making any request. It is free, needs no account, and works on every site that honours it. How to turn it on, including the one case where a site owner can override it. A site can also offer its own “don't count my visits” switch, which the script honours the same way. The UK PECR “statistical purposes” exception needs a simple, free way to object, and the ICO says a browser setting alone is not enough, so a site relying on that exception should offer its own switch as well.
• Raw data is deleted nightly. Individual visit records are only needed to count unique visitors within a day. The nightly job deletes them once their day has ended in the site's own timezone — never more than 48 hours. Page-journey records used for funnels lose their visitor identifier within two nights and are deleted after 90 days.
• What is kept: daily counts per site of views, visitors and sessions, and daily counts broken down by page path, referring host, country, device class, browser, operating system, campaign (utm_source/medium/campaign), custom event name, and outbound-link or download target. These rows do not carry the visitor hash, but a path or other text can itself identify someone (for example, /invoice/1234). They remain while the account exists unless its holder deletes them.
• If a website changes hands. When another Simplytics account proves control of a domain, visits from then on are counted for that account. Statistics collected earlier stay with the previous account unless it hands them to the new one; then the website's new operator holds them. Either way, ask the website's current operator.

People who open simplytics.dev pages

When someone opens a public dashboard, we record how that successful request was served: its time (added by Cloudflare), whether the cache hit, missed, was unavailable or returned an error, and how long the public-site check, cache lookup and report fetch took. The record holds no IP address, user-agent, cookie, visitor identifier, site name, domain, URL or page path, but it is still a per-request record, and its time and measurements could be linked with activity in other systems. Cloudflare deletes these records automatically after three months, wherever it stores them, which may be outside the EU. We use them only to keep public dashboards fast. Private dashboards, unavailable pages and visit beacons do not create them.

Simplytics account holders

• Account data: your current email address, earlier addresses if it changes, an account ID, your sites and settings, and subscription status. For Google or GitHub sign-in we use the provider's account ID and verified address to keep the same Simplytics account when the address changes; we do not ask for a name, picture or profile. An emailed sign-in link involves no identity provider.
• Sign-in links: if you ask for one, we store a one-way hash of the link's token with your address for 15 minutes. The link works once. The hash cannot be turned back into a working link and is deleted the night it expires.
• API keys: if you make one, we store a one-way hash of it, its name, what it may do, when it was made and last used, and when it expires, until you delete it. We count keys made and emails sent each day, deleted the next night. When a key deletes a site or funnel, or makes a site public, we email you first, naming the key.
• Email-change links: if you sign in by emailed link, you can change your email on the Account page. We store a one-way hash of the link's token with your old and new addresses for an hour; the link works once. When the change completes we tell the old address, and your other signed-in browsers are signed out.
• Cookies and browser storage on simplytics.dev itself: one HttpOnly session cookie so you stay signed in, and, during a Google or GitHub sign-in only, two short-lived HttpOnly cookies that carry the OAuth state (10 minutes) and the page you were heading for (5 minutes). Signing in by emailed link sets only the session cookie. The site also keeps small values in your browser's own storage, only after you use the feature they serve: the website you typed on the home page, so sign-up can continue with it; whether the dashboard compares with the previous period and shows countries as a list or a map; and, if you use our “Don't count my visits” switch, one flag that stops us counting you. They stay in your browser; the website name reaches us only if you go on to add that site. None of these is ever set on a site you track.
• Logo and custom domain: if you upload a logo, we store the image and show it on your public dashboard until you remove it or delete the site or account, or the domain moves to another account. If you add a custom domain, we store its name and Cloudflare issues it a certificate; like every certificate, it is listed in public Certificate Transparency logs. It goes on the same events, when your subscription ends, or after 7 days if it never becomes active.
• Referrals: when you open the invite dialog we make a random invite code for your account. If someone creates an account with your link, we record that yours invited theirs; when its first payment succeeds, we record the Dodo payment reference and the free month it earned you. During a sign-in through an invite link, the code is kept with a one-way hash of that sign-in for up to 15 minutes. Neither of you sees the other's name or email.
• Payments are processed by Dodo Payments. We never see or store card details.
• Domain proofs and history handoffs: if you prove control of a domain that another account holds, we keep the proof value for up to 24 hours and record the switch; the previous holder is emailed which domain moved, when and how it was proved. If you request that account's past history, it sees your account email address so it knows who receives its data; if it offers history unprompted, it sees only that the domain's current account will receive it. We keep a record of each handoff: the two accounts, who started it, when, the period and contents, and the wording each side confirmed.
• Deletion: you can delete your account and the analytics it still holds from the Account page. We first cancel your subscriptions with our billing provider, which can take more than one attempt; a subscription already cancelled stays cancelled even if deletion is not yet complete. We keep your account data until we confirm billing has stopped. After each attempt, new checkouts and email changes are paused for up to 24 hours; if deletion does not complete, you may need to request it again. Once deletion succeeds, the account record and its remaining analytics leave the live database immediately. Analytics already handed to another account stay with that account; on that history and its handoff record your account ID is replaced with a one-way reference, removed six years after the handoff or earlier if the recipient deletes the history. If you took over a domain from another account, that account's private copy of its earlier period keeps the same kind of reference to you instead of your account ID, until six years after the takeover. Backups are the exception: Cloudflare's point-in-time restore keeps a rolling window of recent database states (at most 30 days), and a whole-database export is written weekly to private EU storage and deleted 90 days later. Both exist only to recover from a disaster, and no feature reads them. The one routine read is a weekly check that each new export restores: the job that writes it loads it into a temporary database, counts its tables and accounts, and deletes that database, keeping table names, checksums, sizes and counts, not customer-row values. Copies of the data removed by account deletion age out of those backups within 90 days; billing and suppression records can remain as described below.

Other companies involved

The subprocessors page names every company involved, what each gets and where it is. In short:

• Hosting, database, backups and delivery: Cloudflare, which also holds operational logs until 2026-10-23 and three-month performance records for public dashboards. The database and the stored backups are in the EU; the edge, the backup job, the logs and the performance records may be outside it. Its data-processing addendum relies on the EU–US Data Privacy Framework, or on Standard Contractual Clauses and the UK Addendum where that does not apply.
• Email: Resend delivers our automated emails. It processes them in the United States under its data-processing agreement, which relies on Standard Contractual Clauses, the UK Addendum and the EU–US Data Privacy Framework. Apple stores our @simplytics.dev mailboxes in iCloud Mail, under its own terms and not necessarily in the EU.
• Payments: Dodo Payments, the merchant of record and an independent controller of payment data. It handles card details, which we never see, under its own privacy policy, which says it uses Standard Contractual Clauses for transfers from the EEA and UK.
• Code and deploys: GitHub, under its own terms and not necessarily in the EU. It holds our code, working notes with a few account holders' email addresses, and a deploy credential that could be misused to read the database and backups.
• Files our pages load: on simplytics.dev and on public dashboards your browser loads website icons from DuckDuckGo, the chart library from jsDelivr and, if Cloudflare's font rewrite does not apply, Google Fonts from Google; each receives your IP address. This never happens on a site you track.
• Uptime monitoring: Better Stack runs our status page and uptime checks, with no account or visitor data. Opening the status page connects your browser to Better Stack.
• The operator's AI coding tools: Anthropic's Claude Code and OpenAI's Codex. Until 2026-09-23 they sometimes read account data while debugging; since then the operator's rule limits them to counts and database or log field names.

Transfers. The database is administered from India (see below). That access is covered by our own Standard Contractual Clauses and the UK Addendum, in the DPA. Each provider's safeguard is the one stated above and on the subprocessors page; copies of these terms are available on request.

No advertising network, data broker, or third-party analytics or session-recording script runs on simplytics.dev. We count signed-out visits to our marketing, legal, documentation, blog and comparison pages with Simplytics itself. It never loads on sign-in or account pages or on any analytics dashboard, including the public demo, and it does not run when your browser sends Global Privacy Control or after you use the “Don't count my visits” switch on the opt-out page. The public demo displays our own daily counts. A visitor to a site you track is never in contact with anything except Cloudflare's edge.

Where data is stored, and who can reach it

Active analytics data lives in a Cloudflare D1 database whose primary storage is in the European Union (Warsaw, Poland). Weekly backups are stored in EU-jurisdiction storage; the job that makes and checks them runs on Cloudflare's network and is not guaranteed to stay in the EU. Pages are delivered through Cloudflare's global network.

Simplytics is operated by one person based in India. Running the service (deploying code, investigating a fault, answering a support email) means reading that EU-hosted database from India. The EDPB treats an EU controller making EU-stored personal data remotely available to a separate processor in a third country as an international transfer. Whether each Simplytics data flow meets that legal test depends on the parties and roles, but EU hosting alone does not answer it. India has no EU adequacy decision and is not covered by UK adequacy regulations. So that access is covered by the EU Standard Contractual Clauses (Module 2) and, for UK customers, the UK Addendum, both in the data-processing agreement, which also publishes our transfer assessment for India.

What limits it: the primary database stays in the European Union, and account records hold the addresses, IDs, sites, settings and subscription information described above, not a provider profile. What is still missing: there is no EU or UK representative appointed, and the EU clauses are not designed for the case where a customer outside the EU uses Simplytics to measure visitors in the EU. The data-processing agreement says the same.

GDPR

For visitor data, the website operator is the controller and decides why it is collected; Simplytics processes that data for the operator. For account data, Simplytics is the controller. Our tracking script sets no cookies, but the short-lived visitor hash may be personal data and text fields can contain identifying information. Whether a site needs a notice or consent depends on how it uses analytics and on applicable law; the website operator must make that assessment.

If another account proves control of a domain, verification moves to that account. Analytics collected under the previous account stay with it; domain proof alone does not disclose or move that history. A separate handoff of history requires the previous account holder to authorise that recipient and the recipient to accept. Once handed over, the history is held for the receiving account, on its instructions, and no longer appears in the former account. Each website operator decides whether it may hand over or receive that history and what its visitors are told; Simplytics carries out the handoff on the two accounts' instructions.

Why we are allowed to hold your account data

The lawful basis for each purpose:

Scroll the table sideways to see the lawful basis.

Where the basis is legitimate interests you can object; for the marketing ones that takes one click, because every such email carries a link that stops all of them, and the account page has the same switch. Where the basis is consent you can withdraw it at any time; that does not affect anything sent before you withdraw.

How long we keep it

Promotional emails. We don't currently ask for or send promotional emails. We'll update this section before that starts.

• Own-site visit counting — visit rows are deleted nightly, journey records after 90 days, and daily counts are kept while our own Simplytics account exists.
• Raw visit rows — deleted every night, once their day has ended in the site's own timezone. They tell a returning visitor from a new one within a day, so a day's rows are kept while that day is running, and the job that clears them runs at midnight UTC. That makes it about one to two days, and never more than 48 hours. This said “hours, not days” until 2026-09-15, which was never true for any site.
• Funnel journey rows — the visitor identifier is dropped by the second nightly run, so within two nights; the rows are deleted after 90 days, which lets a funnel you define today show the past 90 days.
• Analytics totals and breakdowns — kept while their owning account holds them. Site or account deletion removes owned reports at once, from the dashboard or with an API key. An approved history handoff moves an earlier period to its recipient. Page paths, referrers and event names can contain personal data even when the resulting counts are aggregated.
• History handoff records — an invitation that is declined, withdrawn or expires is deleted 30 days after it closes, or at once if either account is deleted. A completed handoff record is kept while the recipient holds the history. If either account is deleted, its ID on that record and on the history is replaced with a one-way reference, deleted six years after the handoff.
• Your current and earlier email addresses, account and provider IDs, sites, settings and subscription status — until you delete the account, except the one-way references on handoff records and on another account's history, described above.
• Sign-in link hashes — 15 minutes, then deleted the night they expire.
• Referral records — while both accounts exist. Deleting your account deletes your invite code and the invites you sent. If an account you invited is deleted, we stop recording whose it was and keep the month it earned you. Payment references, including that of a payment refunded before it earned a month, are cleared 45 days after the payment, so a refund in that time can still take the month back. Codes held during a sign-in go the night they expire.
• Email-change link hashes — an hour, then deleted the night they expire, or at once if you delete the account.
• Unfinished checkout references — we keep the checkout token, your account address and any provider session ID while your account exists, then remove them when deletion succeeds. We do not discard them on a fixed timer when the checkout link expires, because a payment may still be processing.
• Account-deletion progress — if billing checks need more than one step, we keep minimal provider references and progress. They stop being used after 24 hours and are removed by the next nightly cleanup. Copies in backups follow the retention limits below.
• Sessions — until you sign out, or at most 14 days after you sign in; expired sessions are deleted the following night.
• Public-dashboard performance records — one timestamped record per successful unauthenticated public-dashboard request; Cloudflare deletes each record automatically after three months.
• Operational logs — Simplytics keeps no Cloudflare Workers Logs from 2026-10-20. Earlier logs hold messages from faults, failed visit recording and scheduled-job problems, and expire by 2026-10-23. Request addresses in the site Worker's logs omit the query string, where sign-in, unsubscribe and checkout links can carry tokens or email addresses. A failed request's metadata may include an IP address or user-agent. Before the change on 2026-09-29:
  • until 15:09 UTC, Cloudflare logged every request, including visit beacons, for three days with request metadata that could include an IP address and user-agent;
  • until 14:50 UTC, the automatic request-log URL field included query strings; later automatic entries omitted them;
  • until 15:09 UTC, a separate cache-error message could still contain a full public-dashboard URL;
  • billing and account-portal error paths wrote affected account holders' email addresses into operational logs.
  Entries made before the change will age out by the end of 2026-10-02 (UTC).
• Billing records — Dodo Payments, the merchant of record, keeps its records of each payment as long as the law requires, which is longer than your account. Deleting your Simplytics account does not remove them, and we can still see them in Dodo's dashboard. Our own database removes its subscription references when deletion succeeds, and we keep what our own tax filings require.
• Billing alerts — a dispute, a refund, a billing check that keeps failing, a referral month we could not add or move back in Dodo, or an email change we could not pass to Dodo or tell your old address about leaves a note for us: Dodo's payment or subscription reference, your account ID when we know it, and a short reason. Notes with your account ID or subscription are deleted with your account, and every note 30 days after we deal with it. Each new note is also emailed to us, and that copy stays in our mailbox.
• Bounce and spam-complaint records — kept after account deletion on purpose: one row saying “never mail this address”, so we never mail an address that already told us to stop.
• Backups — a rolling point-in-time window (at most 30 days) and a weekly export deleted 90 days after it is written, so 90 days is the outer edge for copies of deleted account and analytics data in these backups; billing and suppression records follow the separate rules above.

Your rights

Under the GDPR and the UK GDPR you can ask for a copy of your data, to have it corrected, to have it deleted, to restrict what we do with it, to object to processing based on legitimate interests, and to receive it in a portable form. Where we rely on consent you can withdraw it.

You can do most of these yourself: CSV export of your analytics reports at any time, and the email toggles, changing your email and account deletion on the account page. For anything else, email nikhil@simplytics.dev and you will get an answer within one month, with no charge and no form.

Two limits. Stored visit records lose the visitor hash within two days at most, so for a visitor we usually cannot locate the data to act on a request; that follows from the design and is not a refusal. And erasure reaches the live database immediately but backups only as they age out, within the 90 days above.

To complain to us about how we handle your data, email the same address; we acknowledge complaints within 30 days and tell you the outcome.

If we get it wrong, you can complain about us. In the UK that is the Information Commissioner's Office (ico.org.uk/make-a-complaint). In the EU it is the supervisory authority for the country you live in; the European Data Protection Board keeps the list (edpb.europa.eu). You do not have to raise it with us first, though we would rather you did.

Is giving us this data required?

Your email address is required: without it there is no account. Everything else is optional: the summary email, the spike alerts, your timezone, and how many sites you add. Nothing is fed into automated decision-making and nothing is profiled.

Who we are

For your account data the controller is Vemu Nikhil, trading as Simplytics, in Kakinada, Andhra Pradesh, India. Simplytics is one person, not a company; the about page says more. The contact for anything in this policy, including every right above, is nikhil@simplytics.dev.

The full postal address is not published here; it is in the countersigned copy of the DPA, which any customer can ask for. Two things a controller outside the EU and UK is normally expected to have are missing: we have appointed no EU representative and no UK representative. There is also no data protection officer, though at this size one is not required. If you need a representative before you can buy, say so and you will get a straight answer about whether and when.

Contact

Questions about privacy or data requests: nikhil@simplytics.dev