Useful analytics starts with clear boundaries.

Projects provide Automatic, Strict, and Opt-out privacy regimes. The browser tracker starts stateless and uses device storage only when the selected regime or consent permits it. It honors Global Privacy Control and Do Not Track signals.

Stored analytics discard raw IP addresses and raw user-agent strings. URL paths lose query strings, referrers reduce to hosts, and ordinary event properties pass through a privacy filter.

Identified traits are a separate, explicit channel. Do not treat the property filter as permission to send sensitive information.

Organization roles control member access. Resource checks apply to project operations. API keys separate collection, report reads, and management access. OAuth integrations use delegated permissions.

Eligible plans support OpenID Connect SSO and audit-log viewing. Revoke sessions, keys, or connected application access when it is no longer needed.

Public share links can be revoked. They expose an aggregate reporting surface, not individual profiles. Enabling People is an administrator decision that the application records.

Review a shared link's intended audience before distributing it.

Privacy exports, deletion, and account closure are not payment-gated. Individual trait deletion and event erasure are separate operations. Independently managed backups and replicas require their own removal handling.

The privacy draft, DPA draft, and subprocessor status identify the policy details that still need approval.

This page describes implemented controls. It does not claim SOC 2, ISO 27001, a compliance certification, a particular hosting region, an uptime commitment, or encryption at rest.

Use Contact for a security question. Do not include credentials, personal records, or exploit details in an ordinary support message.