# Privacy and your data (/privacy)



This page explains the mechanics, checked against the code that implements them. The binding document
is the [privacy policy](https://usepeeko.com/privacy): it is what Peeko commits to, and this page is
how it works today, in more detail than a policy carries.

The short version: Peeko sets no cookie on the sites it measures, never stores an IP address, and
never builds a profile that follows anybody between sites.

## What is recorded about a visitor [#what-is-recorded-about-a-visitor]

Every page view stores the path with the query string removed, the referring site and any UTM tags on
the link, the country, the device type, the browser and operating system with their major versions,
the screen and window size, whether the browser was in dark mode, the time, and a visitor hash.

If click tracking is on, a click on a tagged element or an outgoing link records the event name and,
for an outbound click, where it went.

The country comes from a header the network in front of Peeko adds, never from a lookup performed on
a stored address. There is no device identifier, no advertising identifier, and no canvas or font
fingerprinting.

## How a visitor is counted without a cookie [#how-a-visitor-is-counted-without-a-cookie]

A visitor's address and browser string are put through a one way keyed hash with a secret only Peeko
holds, and the first part of the result is kept. **The address itself is never written to a database
or a log.**

Two hashes come out of it, and the difference matters.

* **The daily hash** mixes in the date, so it changes for everybody at UTC midnight. It is what the
  People number counts, and it is why nobody can be followed from one day to the next.
* **A second hash without the date** is what lets the dashboard say a visitor is returning rather than
  new, and what links a person's page views into a journey. It is the identity behind visitor
  profiles, goal conversions and funnels.

Peeko stores no profile record: a visitor exists only as their rows, so deleting the rows deletes the
visitor. Analytics are always queried within one site. The secret can be rotated, which resets every
identity at once.

This is also why the resolution is what it is. The hash **fragments** when somebody changes network
or browser and **merges** people behind one address with identical browsers. Peeko says so on the
surfaces where it matters rather than presenting the numbers as more precise than they are.

## Cookies [#cookies]

Peeko sets no cookies on the sites it measures, and nothing it writes on a visitor's device is used
to recognize them later. The only cookie anywhere is the session cookie on `usepeeko.com` itself,
after you sign in to your own dashboard.

The one thing the tracker keeps in a browser is the flag you set deliberately by opening your own site
with `?me=1`, which marks that browser as yours so your visits can be badged and left out of your
numbers. `?me=0` removes it.

## AI crawlers [#ai-crawlers]

The crawler path stores the path, the time, the raw user agent the crawler sent, the company and
agent Peeko classified it as, what it came for, and the response status when your install reports
one. **No address and no visitor hash are involved at all.** A crawler is not a person, and the user
agent is kept because it is what lets old hits be reclassified as the list of known crawlers grows.

## What is stored about you, the customer [#what-is-stored-about-you-the-customer]

Your email address, your name if you gave one, your team and its members, your sites and their
settings, your API keys as hashes, and a customer reference plus a subscription status from Stripe.
**Card details are Stripe's and Peeko never sees them.**

If you connect Google Search Console, Peeko stores the search data for the properties you linked, the
connected account's email address, and an encrypted token that lets it refresh the data. If you
connect Bing Webmaster Tools, it stores the search data and an encrypted token and no address at all,
because Bing's consent screen returns none. Both are deleted when you unlink or disconnect.

Email from Peeko is transactional: sign in links, team invitations, and a warning when your usage
approaches your plan's limit. The only exception is the launch announcement, sent to people who asked
to be told when Peeko launched.

## Who else touches the data [#who-else-touches-the-data]

Six companies, none of them advertising companies.

| Company    | Why                                                                        |
| ---------- | -------------------------------------------------------------------------- |
| Hetzner    | Hosts the servers and the database.                                        |
| Cloudflare | Sits in front of the service and supplies the country a request came from. |
| Stripe     | Handles payment and holds all card details.                                |
| Resend     | Delivers the email.                                                        |
| Google     | Only if you sign in with Google or connect Search Console.                 |
| Microsoft  | Only if you connect Bing Webmaster Tools.                                  |

## How long it is kept [#how-long-it-is-kept]

| Data                                | Kept for                                                          |
| ----------------------------------- | ----------------------------------------------------------------- |
| Page views, events and crawler hits | Three years by default, and a site owner can shorten it per site. |
| Search Console and Bing rows        | Sixteen months.                                                   |
| Live presence rows                  | A day.                                                            |
| Revenue attribution tokens          | Forty eight hours.                                                |
| Your account                        | As long as you have one.                                          |

Retention runs by itself. A site's own window is in its settings and can be set anywhere from 30 days
to ten years.

## Deleting things [#deleting-things]

**A site.** Deleting a site in its settings removes everything recorded for it immediately: its page
views, events, crawler hits, goals, funnels, revenue, share links and both search stores.

**An account.** Self service deletion is not built yet, so write to `privacy@usepeeko.com` from the
address on the account. The account, its sites and all analytics recorded for them are gone within 30
days, and any copy in a backup ages out within a further 30.

**A visitor's data.** If you are covered by the UK's, the EU's or a similar law, you have the usual
rights over your own data, and Peeko answers within 30 days. There is one honest limit: because Peeko
holds no identifier that can be traced back to a person, it usually cannot find one visitor's rows on
request.

## Consent banners [#consent-banners]

Peeko sets no cookie and stores no address, so there is nothing about Peeko for a cookie banner to
ask about. Whether your site needs one for other reasons is a question about the rest of your site,
and this is not legal advice.