Simple Site Analytics

Privacy

This page describes what the Simple Site Analytics application does today. It covers two groups of people: visitors to websites that use our tracking snippet, and people with an account on this dashboard.

Visitors to websites that use the tracker

What the tracker sends

When a page with the snippet loads, when a single-page app moves to a new path, and every 30 seconds while the page stays visible, the tracker sends one small event containing:

  • the site’s public tracking ID and the event type (page view or heartbeat);
  • the page path, with the query string and fragment removed (so /pricing?coupon=x#top is sent as /pricing);
  • on the first page view of a page load only, the host name of the referring website, when it is a different site;
  • a device category (desktop, mobile or tablet), worked out in the browser;
  • a random visitor ID and a random session ID (except on cookieless sites, described below);
  • the browser’s clock time, used only to reject events with an implausible time.

It does not send the page title, page content, form entries, the full URL, the user agent, the screen size, or an email address.

What is stored

The fields above, except the browser’s clock time, are stored together with the time the server received the event. IP addresses and user agents are not stored. The server holds the sender’s IP address in memory only to limit how many events one address can send per minute. Events are accepted only from pages on the site’s registered domain.

What the tracker keeps in the browser

By default the tracker stores the random visitor ID, the session ID, and the time of the last event in the browser’s localStorage, under a key named ssa_ followed by the site’s tracking ID. This lets a returning browser be counted as the same visitor. A site owner can choose data-storage="memory" instead, which stores no visitor or session ID: every page load then counts as a new visitor. The tracker sets no cookies.

Automated browsers and excluded browsers

The tracker sends nothing from a browser that reports it is controlled by automation software (for example a testing tool). A site owner can also stop their own visits being counted: opening their site with #ssa-exclude=on at the end of the address stores one setting, ssa_exclude_ followed by the site’s tracking ID, in that browser’s localStorage, and the tracker then sends nothing from that browser. This setting is written only when someone opens such a link (even if the browser sends Do Not Track or Global Privacy Control, and in every storage mode), is never sent to us, and is removed by #ssa-exclude=off or by clearing the browser’s site data.

Cookieless mode

A site owner can switch a site to cookieless mode. The tracker then stores no ID in the browser (only the exclusion setting described above, if someone opens such a link) and sends no visitor or session ID. Instead, the server computes a visitor ID from the site, the IP address and the browser’s user agent, combined with a secret that is replaced every day and never saved. The IP address and user agent are used only for that calculation and are not stored or logged. The same browser therefore gets a different, unrelated ID each day.

Do Not Track and Global Privacy Control

If the browser sends a Do Not Track or Global Privacy Control signal, the tracker sends nothing at all. A site owner can switch this off with data-respect-dnt="false".

Consent: not decided yet

How Simple Site Analytics should handle visitor consent has not been decided. The visitor ID kept in localStorage is a persistent identifier, and in some places, for example under the EU ePrivacy rules, storing one may require the visitor’s consent. Each site owner is responsible for deciding whether their site needs to ask for it. This page does not say that a consent banner is unnecessary.

How long events are kept

A retention period has not been set yet, and events are not deleted automatically. When an owner removes a site, collection for it stops, and the events already received are kept.

Account holders

  • We store your email address, a hash of your password (never the password itself), your display name and time zone, the accounts you belong to and your role in each, the sites registered in them, when you last signed in, and failed sign-in counts used to lock an account after repeated wrong passwords.
  • The dashboard sets three cookies for signed-in users: ssa.auth (your sign-in session), ssa.csrf (protection against forged requests), and ssa-direction (your left-to-right or right-to-left layout preference).
  • Confirmation and password-reset emails are sent through the email provider configured for the service.
  • If you create a read-only share link for a site, only a fingerprint (hash) of the link is stored, with a hash of its optional password. Anyone with the link can see that site’s dashboard until you revoke it. Viewers of a password-protected link get a short-lived cookie (ssa.share) that remembers the password was entered.
  • Administrator actions on user accounts (for example locking, unlocking, or deleting one) are recorded in an audit log.
  • These pages load no third-party scripts, fonts, or analytics.

The web server that hosts the application may keep its own standard access logs; this page describes the application.