Privacy
It would be strange to sell privacy-first analytics from a site that tracked you. This one counts visits the way the plugin does: no cookie, no stored IP address, and nothing loaded from another company's server.
What this website collects
Very little. Every page is a static file. There is no login, no form, no comment box, and no newsletter sign-up. The JavaScript on the site opens and closes the menu on small screens and sends the anonymous count described below.
You can check this rather than take my word for it: open your browser's network panel and confirm every request goes to this domain and no other.
That covers this website and nothing more. Buying a licence takes you to a separate application on the pro subdomain, which does have a sign-in and does keep records. It is set out in full further down rather than left hiding behind the word "nothing".
How visits are counted
What's recorded. The page you viewed; the site you came from, as a
hostname only (or the utm_source and utm_campaign in the link,
if there are any); whether you're on a phone, tablet or desktop, worked out from your
browser's user-agent string; your country, as Cloudflare reports it; and clicks to a few
named places: WordPress.org, checkout, the demo, GitHub, and a handful of buttons on
this site.
How daily visitors are counted. Your IP address and user agent are combined with a random value, the salt, and put through a one-way hash. The salt exists for one UTC day and is then destroyed. The hashes are deleted the next day, so yesterday's visits can't be linked to anyone, including by me.
What isn't kept. IP addresses, user-agent strings, full referring URLs, cookies, anything in your browser's storage, and any profile that links one day to another or this site to any other.
Global Privacy Control. If your browser sends it, you aren't counted at all.
Where it's stored. Hourly totals go in a Cloudflare D1 database in my own Cloudflare account. Cloudflare already hosts the site, and nothing is shared with anyone else. The totals themselves are public at this site's numbers, with rarely seen referring sites and countries left out.
How long. Hourly totals are kept. Visitor hashes are gone the day after.
What the web host sees
The site is served by Cloudflare. Like any web server, theirs processes the technical details of your request - your IP address, the page you asked for, your browser's user-agent string - in order to deliver the page and to protect the site from attack. That is Cloudflare acting as my hosting provider, and it is covered by Cloudflare's privacy policy. I do not receive per-visitor logs from them and I do not analyse this data.
If you buy a licence
Checkout is handled by Stripe. They collect your name, email address, billing details, and they take the payment. Card details never touch this site or any system of mine.
The sale is made by Onelink, Stripe's merchant of record, so the payment, the VAT and the invoice are theirs. I receive your name, email address and order details so I can issue your licence key and answer support requests. I never see your card number. Stripe's handling of your data is covered by their privacy policy.
What the account area holds
Buying a licence gives you an account on the pro subdomain, where you can see your licences, manage which sites a key is activated on, download the plugin and reach your invoices. Unlike this website, it keeps records. All of them, in full:
- Your email address and name, from Stripe at checkout. Kept until you ask me to remove them.
- The site addresses your licence is activated on, so the activations can be counted and shown back to you.
- A log of licence checks - a prefix and a hash of the key, the site address, what was asked, what was answered, and the plugin, WordPress and PHP versions. No IP addresses. Deleted after 180 days.
- One cookie, and only while you are signed in.
Two processors are involved and no others: Stripe, including Onelink for the sale and the invoices, and Mailgun for the sign-in and receipt emails. Nothing else leaves the server.
If you email support
Your message, your email address and anything you include - a licence key, a site URL, a screenshot - reach my inbox and stay there. I keep support correspondence so I can pick up a thread later. Ask me to delete it and I will.
What the plugin collects
This page is about the website. The plugin is a separate matter, and a much longer one: it stores everything in your own WordPress database, sets no analytics cookie by default, never stores an IP address, and makes no outbound request to me or anyone else. The privacy documentation covers exactly what it keeps and what it discards.
Your rights
Under UK and EU data protection law you can ask for a copy of the personal data I hold about you, ask me to correct it, or ask me to delete it. Email support@honest-analytics.com and I will respond within one month. That covers the account area as well as this website, because I hold both. Stripe keeps its own record of the payment as my processor, and if that is what you need, ask me first and I will sort it out rather than sending you away.
If you think I have handled your data badly, you can complain to the Information Commissioner's Office in the UK, or to your local supervisory authority in the EU.
Changes
If this notice changes in a way that matters, the date at the top changes with it.
Who to contact
Honest Analytics is made by Coysh Digital Ltd, registered in England and Wales, company number 16868808, trading as Coysh Digital. For anything on this page, email support@honest-analytics.com.