Privacy Policy

This policy covers two kinds of people: account holders — people who sign up for VisitTrack to track their own site(s) — and site visitors — the (mostly anonymous) people whose traffic an account holder's site tracks. For a detailed breakdown of what we collect about site visitors specifically and why, see our GDPR page — this document is the general policy; that one is the detailed technical companion.

When you create a VisitTrack account, we collect:

• your email address and, if you sign up with a password, a securely hashed password — never the plaintext;
• your name and profile picture, if you sign up or log in with Google;
• the domain(s) and site name(s) you register for tracking;
• billing details, handled entirely by Stripe — we store your plan and subscription status, never your card number;
• support/contact messages you send us.

We use this to operate your account, send transactional email (password resets, billing receipts), and provide support.

The tracking script builds no cross-site profile. In standard mode it keeps one anonymous first-party visitor id (the _vt_vid cookie on the site's own domain, mirrored in local storage) so return visits are recognized; in cookieless mode it stores nothing on the device and the id is a server-side hash that rotates daily; in hybrid mode visitors in the EU/EEA, UK and Switzerland get cookieless treatment and everyone else the standard id. Per pageview or custom event, we record: the page path, referrer and UTM/ad-click parameters, approximate country/region/city derived from IP (the IP itself is used transiently and not stored), device/browser/OS, and a visitor identifier generated locally in localStorage, scoped to that one site. See /gdpr for the full list and retention details.

IP geolocation. Location is looked up on our own server against a local copy of DB-IP's free database; only addresses it can't resolve (mostly IPv6) are sent to ip-api.com, which returns the location and keeps nothing on our behalf. IP Geolocation by DB-IP, licensed under CC BY 4.0.

A site owner can turn on session replays for their site. They are off unless the owner enables them, and even then only a sampled share of visits (20% by default, set by the owner) is recorded. Visits classified as bots or automated browsers are never recorded, and a visit that leaves within the first few seconds is never uploaded.

For a recorded visit, a separate recorder script loads and captures the page structure, mouse movement, clicks, scrolling and viewport size, so the visit can be played back as it happened. By design it does not capture: anything typed into a form field (every input, textarea and select is masked in the visitor's browser, before anything is sent), passwords, the contents of elements the owner blocks or masks, embedded frames, video, audio or canvas content, network requests, console output, or the query string and fragment of page URLs. The recorder writes nothing to cookies or browser storage; a recording is linked to the visit by a short-lived signed token issued by our server.

Recordings are stored on our own infrastructure (never with a third party), are visible only to the members of the site's team — never on a public dashboard — and are deleted automatically after 30 days. The site owner can delete all of a site's recordings at any time. Page text can still appear in a recording unless the owner masks it (per element, or all text at once), so site owners who enable replays are responsible for masking any personal data their pages display and for telling their visitors in their own privacy notice. See the session replays documentation for the technical details.

• to provide the analytics dashboard and the features you enable (goals, funnels, revenue attribution);
• to send account-related email — verification, password reset, billing, and, if you opt in, product updates;
• to detect and prevent abuse of the service (rate limiting, bot filtering);
• to improve the product — in aggregate, never by reading an individual visitor's activity for purposes unrelated to your dashboard.

We don't sell data, and we don't share visitor data with advertising networks. Data passes through a small set of subprocessors needed to run the service:

• Stripe — billing and payment processing;
• Resend — email delivery: account and billing emails, plus product tips and reminders you can unsubscribe from in one click;
• Google — only if you connect Search Console, and only for the read-only search-analytics scope you authorize;
• our hosting infrastructure, which stores the database VisitTrack runs on.

Our own ads on X (Twitter). This only concerns people who sign up for VisitTrack after clicking one of our ads on X — never your site's visitors, and never anyone who didn't arrive from one of those ads. X adds a click id to the ad link; we keep it in a first-party cookie (vt_twclid, 90 days) and on your account. When you sign up, and when you first pay, we send X that click id and a SHA-256 hash of your email address so X can count the conversion for our ad. We don't install X's pixel and X gets nothing else. To opt out, email us and we'll remove the click id from your account.

The in-app assistant. Questions you ask the “Ask VisitTrack” assistant are sent to OpenAI, which provides the AI model, to generate the answer. When you're signed in, your conversations are stored on your account so you can see your history, and VisitTrack staff may review them for support and quality; you can delete any conversation from the chat's history. Chats with the assistant on our public docs are not stored.

We disclose data if required by law, or to protect the security or rights of VisitTrack, our customers, or the public.

Account data is retained for as long as your account is active, plus a limited period after closure to comply with legal/billing obligations. Analytics event data is retained per your plan's data-retention window; deleting a site or closing your account removes its associated event data. Session replay recordings, where a site owner has enabled them, are deleted after 30 days regardless of plan. You can request earlier deletion at any time — see Your rights below.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights — for your own account, or on behalf of a site visitor who has contacted you — email privacy@visitrack.app. We respond within 30 days.

We use industry-standard measures to protect data in transit (TLS) and at rest, restrict internal access on a need-to-know basis, and store passwords hashed, never in plaintext. No method of transmission or storage is 100% secure; we can't guarantee absolute security, but we treat data protection as a core product requirement, not an afterthought.

VisitTrack is a B2B analytics tool not directed at children, and we don't knowingly collect personal data from children under 16.

If we make material changes to this policy, we'll notify account holders by email and update the “last updated” date below before the change takes effect.

Questions about this policy or how your data is handled: email privacy@visitrack.app.