Ask before you connect anything.

Both. Website reports explain where visitors come from and which pages they use. Product reports — goals, funnels, retention cohorts, segments and journeys — examine what happens after they arrive. You define the events that explain activation.

No. There is no session replay and no screen recording. Session activity lists the events that were collected, and an optional heatmap combines click or scroll activity on a page.

Yes. The demo opens the dashboard with no account, and its banner says whether the figures are a labelled sample or a live public link. A sample is never a claim about customer activity.

None is claimed. Messages reach the address configured for the application; no response time is promised, because none has been committed to.

The browser tracker for websites and single-page apps, and the HTTP API for server events and aggregate queries. Client libraries are not currently published on package registries.

Plausible, DataVisitors and generic CSV exports import as aggregate history. An import cannot recreate original sessions or individual retention.

No. Imported history shows in page and source totals and is structurally excluded from session metrics, so a bounce rate never mixes two definitions.

It starts stateless and sets no cookie. The privacy regime and consent decide whether device storage is ever used.

No. Aggregates are the starting point, and People is off until an administrator switches it on.

Stateless measurement uses a daily identifier that differs between projects. Device storage depends on the project's privacy mode and the visitor's consent. A rotating identifier does not guarantee that all data is anonymous.

A per-project choice of what the tracker may keep on the device and which location fields the service records: automatic by the visitor's region, strict everywhere, or relaxed. The manual's "Counting correctly" chapter states exactly what each one changes.

One request from their profile. The service's worker deletes their events and traits and keeps a hashed tombstone, so the deletion can be shown to have happened without keeping who it was.

No. No SOC 2, ISO 27001, HIPAA or PCI DSS certification is held, and no badge suggesting otherwise is displayed. The security page lists the practices that are actually implemented.

Yes — a revocable public link shows aggregate reports without an account. Individual profiles never appear on it.

Aggregates: the headline, the series, top pages, sources, countries and devices, or one board, or the reports, or country totals on the people map. Never a visitor, a session or a trait. Revoke it and the address stops answering.

Owners and admins manage members, projects, keys and settings; analysts save reports and request exports; members read; viewers read only. Only the owner moves a project or requires a second factor of everyone.

Four plans, starting at Free, differ by events, history, projects, seats and features. Past the allowance collection continues; the plan gates reading.

The events per month, the retention, the number of projects and seats, and which features are on — funnels and weekly delivery from Starter, retention cohorts, AI explanations and the consolidated overview from Growth, single sign-on, the audit trail and monthly exports on Business.

Join the waitlist with the address the invitation should go to, and confirm it from the one mail we send. When a seat opens, the invitation opens registration for that address alone for seven days.

No. Reports describe collected activity and attribution follows its own definition. Suggested actions need your review; they don't establish causation.