Privacy Notice Template

This site measures its traffic with Open Analytics, a privacy-first analytics service. The measurement is designed so that it cannot identify you, and the properties below are design properties of the software, not promises of restraint:

• No cookies, and no identifier for you stored on your device. Nothing the script stores identifies you, and nothing it stores is readable by another site.
• No raw IP address is ever stored: not in a database column, not in a log line, not in an event.
• No device fingerprinting. The only browser information used is a deliberately coarse class: device type, browser family, and operating system family, with no versions.
• No cross-site tracking. The same person on two different sites produces two unrelated identifiers with no way to connect them.
• No cross-day tracking. The visitor identifier expires at UTC midnight, every day.
• No advertising profiles, no data brokers, no third-party ad code.
• No keystrokes, no session replay, no screenshots, no form values. The value of an input field is never captured, at any layer.

To count unique visitors, the analytics service derives a pseudonymous identifier on its server: a keyed hash (HMAC-SHA256) whose inputs include the site's ID, the current UTC calendar date, a coarse browser class, and the visitor's IP address. Three consequences follow directly from that construction: the identifier cannot be reversed into an IP address, it is different on every site, and it expires every day, because the calendar date is one of the inputs. Nobody, including the analytics provider, can follow a visitor from one day to the next.

One bounded exception, stated openly: a visit in progress at UTC midnight would otherwise be cut in half and counted twice. To avoid that, the two halves are joined when, and only when, the events fall within a 30-minute window straddling that single midnight, carry a matching per-tab session hint, and are on the same site. A joined session is flagged in the data as joined. It bridges one midnight, once, inside half an hour, and cannot reconstruct long-term tracking.

The IP address is read once, used for two things, and discarded before the analytics event exists. It resolves a country and city from a database file on the analytics provider's own server (the address is never sent to any geolocation service), and it feeds a short-lived rate-limit counter that expires within minutes. It is never stored in analytics data, never logged, and never put on an event.

When you sign in, this site attaches its own pseudonymous account reference to analytics events so that a returning signed-in user can be recognised across visits. The reference is not your email address or name, and it is hashed before storage. Unlike the anonymous visitor identifier, it does not expire daily; that is its purpose, and it applies only to signed-in users of this site.

Describe here how you ask before doing this, and keep this section only if you do it. The same goes for linking a purchase back to the visit that led to it: that is a separate feature this site switches on deliberately, and without it a purchase is still counted but is not connected to a visitor.

Note for the site owner, delete before publishing: the analytics script does not withhold either of these on your visitors' behalf — you call them, so the consent question is yours to answer. Wire your own check, and use oa.consent("granted") / oa.consent("denied") to tell the script what the visitor said. Consider a review by your own counsel before you rely on this section.

This site records where on the page visitors click, to understand which parts of a page get used. What is recorded is limited by a closed schema: the click position as a percentage of the viewport, a coarse element size class, the viewport width, a short CSS path to the element, and the element's visible text if it has any. Before anything is sent, all of it is sanitized in the browser: the value of an input field is never captured, anything resembling an email address or a long number is replaced with a redaction marker, and redaction runs before truncation so a cut tail can never leak. What is never collected: pixel coordinates, mouse movement paths, scroll recordings, screenshots, DOM snapshots, or any keystroke.

The analytics sets no cookies and stores no identifier for you. It keeps four short-lived technical values in your browser: a per-tab session hint, a queue of events not yet delivered, this site's consent state, and a cached copy of the site's analytics settings. None of them identifies you, none is readable by another site, and the visitor identifier itself is worked out on the analytics server and expires at UTC midnight.

The basis for using them without a banner is first-party audience measurement: they exist to produce aggregate statistics for this site alone, they are never combined with data from other sites or services, they are never shared onward, they are kept for a limited time, and an opt-out is available and works. The script also honours browser-level opt-out signals — a visitor sending Global Privacy Control is not measured, and Do Not Track is honoured by default.

Delete this section if you use either of the two features above.The site's own user identifier and attributed revenue go beyond aggregate measurement, so this reasoning does not reach them; keep the "Identified users" section instead, and describe how you ask. Whether they need consent on your site is a question about your site, and it is yours to assess.