Useful analytics.
Nothing kept that isn’t.
What is collected, how visitors are counted, and how long it stays — in full.
The foundation
Nothing on the device.
No cookie, no local storage, nothing written to or read from a visitor’s browser.
No IPs, no user agents.
Both are used to compute a rotating hash at ingest and are never written down.
No cross-site joining.
The domain is inside the hash, so the same person on two sites is stored as two different visitors.
What a pageview records
Every dimension the reports can break down by, in full — this is the list, not a summary of it:
- The page, and the entry and exit page of the visit; the hostname.
- Referrer, and the source, channel and UTM parameters derived from it.
- Device type, browser and version, operating system and version.
- Country, region and city — derived from the request, never from a stored IP.
- Event name, and any custom properties you choose to attach.
Sessions additionally hold the first-touch acquisition of the visit, plus the geo and device above. Engagement pings record scroll depth and engaged time. If you enable site-search capture, the search term is lowercased, whitespace-collapsed, and stripped of email addresses and runs of seven or more digits at ingest — the raw string is never stored.
How a visitor is counted
A visitor is a hash of the user agent, IP and domain under a salt that rotates every 24 hours and is deleted after 48. Once that salt is gone the hash cannot be recomputed by anyone, including us. Visitor counts are therefore per-day: a multi-day figure sums daily distinct counts, someone changing network or browser counts twice, and there is no cross-day journey. Visits, pageviews and events are exact.
How long it is kept
- Hash salts: 48 hours, then deleted.
- Raw events: 180 days by default, then purged.
- Daily aggregates — what the reports actually read: 16 months.
Those periods run on their own. Separately, you can ask for your data to be deleted at any time: write to us and it is done within 30 days, covering the account, the workspaces you own and the analytics data for the sites in them.
Where it is processed
FunnelSights runs on Railway in the United States — the application services and the Postgres database holding your data. For EU and UK visitors that is an international transfer, and a contract covering it needs an appropriate safeguard such as standard contractual clauses. Every third party that can access data is named in the sub-processor register.
What never reaches the data at all
Bot traffic is dropped at ingest against a maintained crawler database, and referrer spam against the Matomo spam list, so neither enters your reports. Your pages make no third-party request to the tracker’s host, and you can proxy ingest through your own domain.
The formal notice.
Controller identity, the legal basis for each purpose, international transfers, and the rights you can exercise — written as the notice Article 13 asks for.
The privacy policyWho else can see it.
Every third party that can access data we process on your behalf, why it is in the path, and which of them are switched off entirely.
The sub-processor registerRead the mechanism.
The hashing scheme, what it guarantees, and the accuracy it costs — written out rather than summarised.
How cookieless measurement worksGet a clearer view.
Start with a look at the product — no account needed.