Privacy and your data
What Peeko records, what it refuses to record, how long it keeps it, and how to have it deleted.
This page explains the mechanics, checked against the code that implements them. The binding document is the privacy policy: it is what Peeko commits to, and this page is how it works today, in more detail than a policy carries.
The short version: Peeko sets no cookie on the sites it measures, never stores an IP address, and never builds a profile that follows anybody between sites.
What is recorded about a visitor
Every page view stores the path with the query string removed, the referring site and any UTM tags on the link, the country, the device type, the browser and operating system with their major versions, the screen and window size, whether the browser was in dark mode, the time, and a visitor hash.
If click tracking is on, a click on a tagged element or an outgoing link records the event name and, for an outbound click, where it went.
The country comes from a header the network in front of Peeko adds, never from a lookup performed on a stored address. There is no device identifier, no advertising identifier, and no canvas or font fingerprinting.
How a visitor is counted without a cookie
A visitor's address and browser string are put through a one way keyed hash with a secret only Peeko holds, and the first part of the result is kept. The address itself is never written to a database or a log.
Two hashes come out of it, and the difference matters.
- The daily hash mixes in the date, so it changes for everybody at UTC midnight. It is what the People number counts, and it is why nobody can be followed from one day to the next.
- A second hash without the date is what lets the dashboard say a visitor is returning rather than new, and what links a person's page views into a journey. It is the identity behind visitor profiles, goal conversions and funnels.
Peeko stores no profile record: a visitor exists only as their rows, so deleting the rows deletes the visitor. Analytics are always queried within one site. The secret can be rotated, which resets every identity at once.
This is also why the resolution is what it is. The hash fragments when somebody changes network or browser and merges people behind one address with identical browsers. Peeko says so on the surfaces where it matters rather than presenting the numbers as more precise than they are.
Cookies
Peeko sets no cookies on the sites it measures, and nothing it writes on a visitor's device is used
to recognize them later. The only cookie anywhere is the session cookie on usepeeko.com itself,
after you sign in to your own dashboard.
The one thing the tracker keeps in a browser is the flag you set deliberately by opening your own site
with ?me=1, which marks that browser as yours so your visits can be badged and left out of your
numbers. ?me=0 removes it.
AI crawlers
The crawler path stores the path, the time, the raw user agent the crawler sent, the company and agent Peeko classified it as, what it came for, and the response status when your install reports one. No address and no visitor hash are involved at all. A crawler is not a person, and the user agent is kept because it is what lets old hits be reclassified as the list of known crawlers grows.
What is stored about you, the customer
Your email address, your name if you gave one, your team and its members, your sites and their settings, your API keys as hashes, and a customer reference plus a subscription status from Stripe. Card details are Stripe's and Peeko never sees them.
If you connect Google Search Console, Peeko stores the search data for the properties you linked, the connected account's email address, and an encrypted token that lets it refresh the data. If you connect Bing Webmaster Tools, it stores the search data and an encrypted token and no address at all, because Bing's consent screen returns none. Both are deleted when you unlink or disconnect.
Email from Peeko is transactional: sign in links, team invitations, and a warning when your usage approaches your plan's limit. The only exception is the launch announcement, sent to people who asked to be told when Peeko launched.
Who else touches the data
Six companies, none of them advertising companies.
| Company | Why |
|---|---|
| Hetzner | Hosts the servers and the database. |
| Cloudflare | Sits in front of the service and supplies the country a request came from. |
| Stripe | Handles payment and holds all card details. |
| Resend | Delivers the email. |
| Only if you sign in with Google or connect Search Console. | |
| Microsoft | Only if you connect Bing Webmaster Tools. |
How long it is kept
| Data | Kept for |
|---|---|
| Page views, events and crawler hits | Three years by default, and a site owner can shorten it per site. |
| Search Console and Bing rows | Sixteen months. |
| Live presence rows | A day. |
| Revenue attribution tokens | Forty eight hours. |
| Your account | As long as you have one. |
Retention runs by itself. A site's own window is in its settings and can be set anywhere from 30 days to ten years.
Deleting things
A site. Deleting a site in its settings removes everything recorded for it immediately: its page views, events, crawler hits, goals, funnels, revenue, share links and both search stores.
An account. Self service deletion is not built yet, so write to [email protected] from the
address on the account. The account, its sites and all analytics recorded for them are gone within 30
days, and any copy in a backup ages out within a further 30.
A visitor's data. If you are covered by the UK's, the EU's or a similar law, you have the usual rights over your own data, and Peeko answers within 30 days. There is one honest limit: because Peeko holds no identifier that can be traced back to a person, it usually cannot find one visitor's rows on request.
Consent banners
Peeko sets no cookie and stores no address, so there is nothing about Peeko for a cookie banner to ask about. Whether your site needs one for other reasons is a question about the rest of your site, and this is not legal advice.