No cookies. No personal data in analytics.

Analytics

No cookies, nothing stored on your device, no personal data. Endpoints: POST /_care/event, POST /_care/event/<name>, GET /_care/script.js.

What a request carries:

• the event name (for example "pageview" or "signup")
• the page address, of which only the site name (host) and the path are kept (query strings and #fragments are dropped, except utm_source, utm_medium and utm_campaign; ref or source stands in for a missing utm_source). A part of the path that looks like an email address is replaced by ":email", and such a utm value is dropped
• the referring site, of which only its host name is kept (for example "google.com")
• the screen width (to tell phone, tablet and desktop apart) and the browser language
• optional event properties set by the app, which must not contain personal data: names or values that look like an email address, and values that look like a browser User-Agent or an IP address, are refused

Used for a moment, never written:

• the IP address and the browser identifier (User-Agent), only in memory, to make a visitor code and to rate-limit; they are never written anywhere
• the country, from the network provider (Cloudflare) header

A visitor is counted with a code made from a random value that changes every day (UTC) plus the IP address and browser identifier. The random value is deleted at the end of the day, after which the code cannot be traced back to anyone or matched with any other day. So the same person on two days counts as two visitors; nobody is followed across days or across sites.

Never stored:

• IP addresses
• User-Agent strings
• cookies or device identifiers
• names, email addresses or account ids
• query strings and fragments of page addresses
• fingerprints

Events are deleted after 750 days.

Feedback, bug reports, messages and waitlist

Endpoints: POST /_care/feedback, POST /_care/bug, POST /_care/message, POST /_care/waitlist, GET|POST /_care/unsubscribe.

Feedback, bug reports, messages and waitlist signups keep what the person wrote, including an email address if they gave one (a contact message and a waitlist signup need one, to answer). Nothing is added from the device beyond the site (host) it was sent from, the browser name, operating system, device type, country and language. The IP address is not stored. Email addresses are stored encrypted (AES-256-GCM), with a keyed hash to find them for an erasure or export request. Every waitlist signup can be removed by its unsubscribe link.

Every request (open or not) and its attachments are deleted at the latest 365 days after it was sent.

Resolved requests are deleted after 730 days, spam after 30 days, attachments after 30 days; backups are kept 7 days.

Ask the site that sent you here to delete or export what you sent; they can find and remove everything sent with an email address at once.