Privacy Notice Template

This site measures its traffic with Open Analytics, a privacy-first analytics service. The measurement is designed so that it cannot identify you, and the properties below are design properties of the software, not promises of restraint:

• No cookies, and no identifier stored on your device. Nothing the script stores identifies you, and nothing it stores is used to recognise you.
• No raw IP address is ever stored: not in a database column, not in a log line, not in an event.
• No device fingerprinting. The only browser information used is a deliberately coarse class: device type, browser family, and operating system family, with no versions.
• No cross-site tracking. The same person on two different sites produces two unrelated identifiers with no way to connect them.
• No cross-day tracking. The visitor identifier expires at UTC midnight, every day.
• No advertising profiles, no data brokers, no third-party ad code.
• No keystrokes, no session replay, no screenshots, no form values. The value of an input field is never captured, at any layer.

To count unique visitors, the analytics service derives a pseudonymous identifier on its server: a keyed hash (HMAC-SHA256) whose inputs include the site's ID, the current UTC calendar date, a coarse browser class, and the visitor's IP address. Three consequences follow directly from that construction: the identifier cannot be reversed into an IP address, it is different on every site, and it expires every day, because the calendar date is one of the inputs. Nobody, including the analytics provider, can follow a visitor from one day to the next.

One bounded exception, stated openly: a visit in progress at UTC midnight would otherwise be cut in half and counted twice. To avoid that, the two halves are joined when, and only when, the events fall within a 30-minute window straddling that single midnight, carry a matching per-tab session hint, and are on the same site. A joined session is flagged in the data as joined. It bridges one midnight, once, inside half an hour, and cannot reconstruct long-term tracking.

The IP address is read once, used for two things, and discarded before the analytics event exists. It resolves a country and city from a database file on the analytics provider's own server (the address is never sent to any geolocation service), and it feeds a short-lived rate-limit counter that expires within minutes. It is never stored in analytics data, never logged, and never put on an event.

When you sign in, this site attaches its own pseudonymous account reference to analytics events so that a returning signed-in user can be recognised across visits. The reference is not your email address or name, and it is hashed before storage. Unlike the anonymous visitor identifier, it does not expire daily; that is its purpose, and it applies only to signed-in users of this site.

This site records where on the page visitors click, to understand which parts of a page get used. What is recorded is limited by a closed schema: the click position as a percentage of the viewport, a coarse element size class, the viewport width, a short CSS path to the element, and the element's visible text if it has any. Before anything is sent, all of it is sanitized in the browser: the value of an input field is never captured, anything resembling an email address or a long number is replaced with a redaction marker, and redaction runs before truncation so a cut tail can never leak. What is never collected: pixel coordinates, mouse movement paths, scroll recordings, screenshots, DOM snapshots, or any keystroke.

The analytics operates without cookies, without a persistent identifier on your device, and without personal data. Under the ePrivacy rules, the consent trigger is storing or reading information on your device for identification, which this design does not do. The script additionally honours browser-level opt-out signals: a visitor sending Global Privacy Control is not measured, and Do Not Track is honoured by default.