Data policy
Exactly what Flatlytics collects, how the visitor hash works, and how long data is kept. No surprises, no fine print.
Every field we collect
An event is a small JSON payload. The tracker sends the fields in the first group; our edge adds the second group. Nothing else is collected.
| Field | What it is | Retained |
|---|---|---|
| Sent by the tracker | ||
| k | Your site's public key: identifies which site the event belongs to. | stored |
| i | A random 32-hex event id minted in your browser, used only to de-duplicate retries. | stored |
| e | The event name (e.g. "pageview"), up to 64 characters. | stored |
| u | The page URL. We keep host + path and strip known personal query params. | stored |
| r | The referrer URL. We keep the referring domain only. | derived |
| w | Viewport width, used to bucket device type. | stored |
| p | Custom properties you choose to send (flat strings / numbers / booleans, ≤4KB). | stored |
| uid | An optional user id you provide. Stored verbatim if you send it, otherwise nothing. | stored |
| Added at the edge | ||
| ip | Your visitor's IP, used only to compute the daily visitor hash, then discarded. | never stored |
| user agent | Parsed into browser / OS / device type. The raw string is not kept. | derived |
| geo | Approximate country / region / city / timezone from the edge network. | stored |
Known personal query parameters are stripped from the URL before storage, and self-referrals are dropped from referrer data.
The daily salt rotation
Unique visitors are counted via sha256(daily_salt · site · ip · user_agent), truncated. The salt is generated once per day and stored server-side; it is never exposed. When the salt rotates at UTC midnight, the previous day's hashes become uncorrelatable with the new day's.
To avoid splitting a session across midnight, for 30 minutes after midnight we also check the previous day's hash and continue an in-progress session, but the stored event always carries the new day's hash. Distinct-visitor counts still reset at midnight by design.
How long we keep data
Retention is enforced by clamping how far back a query can reach, not by deleting your data. In v1 there is no plan-based deletion at all, so a plan change is always reversible.
| Plan | Query window |
|---|---|
| Free | 6 months (183 days) |
| Pro | 24 months (730 days) |
| Business | 36 months (1095 days) |
Hosting location
Your analytics data is stored on our hosting provider's infrastructure, in the region pinned at deployment. We state the specific region here rather than promising a location we might change.
No visitor-level deletion
Because the visitor hash rotates daily, there is no durable identifier to look a person up by, so we can't offer self-serve visitor deletion. Collecting less, and briefly, is the point.