Cookie Free Analytics

Legal

Data Processing Agreement

Last updated 26 August 2026. An addendum to the Terms. The engineering recipe is /methodology. This is not legal advice and not a “GDPR compliant” badge.

If you accept this DPA for an organisation, you warrant that you can bind that organisation. Using Cookie Free Analytics to measure a site you control is your instruction to process visitor data as described here.

What this covers

Visitor measurement: pageviews and named events sent by cf.js (and optional cf-clicks.js) from sites you add. You are the controller of that visitor data. Cookie Free Analytics is the processor.

This DPA does not make us your processor for your own account (name, email, password hash, billing). We are the controller of that customer record. See Privacy.

Roles and words

  • Customer / you — the person or organisation that adds a site and pastes the script.
  • Visitor data — the fields listed below, generated when someone loads a page on your site.
  • Data Protection Legislation — GDPR (Regulation (EU) 2016/679) and other privacy laws that actually apply to the processing. We do not pick your lawful basis for you.
  • “Personal data”, “processing”, “controller”, “processor”, “data subject” have their GDPR meanings.

What we process

The browser sends site public id, hostname, path, referrer, and an optional event name. POST JSON, so those fields are not sitting in a query-string CDN log. Query strings are dropped except five UTM tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term).

On the row we store: path, hostname, referrer (origin + path), a cleaned source label, country / region / city from the edge (no coordinates, no postal code), browser / OS / device family, the five UTM fields when present, an optional event name, a 16-byte visitor digest, and a timestamp. We do not set a cookie, do not write localStorage, and do not fingerprint.

To count one person once per UTC day we briefly use the request IP and User-Agent, HMAC them with a server pepper and a daily salt we then delete, store only the digest, and discard the IP. The next day the salt is gone. Days cannot be joined. That digest is still personal data. We do not call it anonymous. The formula is on the method page.

A short-lived quota counter uses a 16-character SHA-256 prefix of the IP (not the IP) so Frankfurt isolates share a 60/min cap. Those rows are not the pageview log and are dropped after a few minutes.

Data subjects are people who load pages on sites where you installed the script. You must have a lawful basis to measure them. We do not invent one.

Where it lives

Beacons hit Vercel functions pinned to Frankfurt (fra1). Pageview rows sit in EU Postgres — currently Ireland (eu-west-1), not Virginia. We do not forward visitor rows to an advertising graph. See /europe.

Vercel and the database vendor are US-incorporated companies that offer EU regions. That is not “European-owned infrastructure.” We will not write that sentence.

Subprocessors (visitor data)

These parties may process visitor data because the beacon and the rows pass through them. We use them only to run the service.

  • Vercel, Inc. (United States) — hosts the app and /api/collect in Frankfurt. The HTTP request includes IP and User-Agent at the edge; Vercel supplies country, region, and city headers. We do not control Vercel’s own platform logs. Their customer DPA / SCCs apply to that layer.
  • EU Postgres (Ireland, currently Supabase / eu-west-1) — stores pageview rows and the short ingest-quota hashes. Not a US region with a DPA stapled on for the data at rest.

Not visitor subprocessors (they do not receive your pageview log): Resend (mail to you), Stripe (charges on Starter or Growth), Cloudflare Turnstile (optional email-login challenge), Google or X if you sign in with them, Search Console if you connect it. Those are described on Privacy. Period briefing and Set up this site are owner-initiated: if you click them, xAI (United States, Grok) receives dashboard aggregates and, for setup, the homepage title and path list — not hashes, not IPs, not the pageview log. The briefing is stored in Ireland Postgres. Those clicks are capped per account per day. A change to the visitor list above will be dated on this page and on /changelog. If you object, stop sending beacons and delete the site.

What we will not do with visitor data

  • Sell it, or enrich it for ads.
  • Build cross-site or cross-day identity.
  • Session replay, heatmaps, or scroll maps.
  • Store raw IP on the pageview row, or lat/long, or postal code.
  • Run a MaxMind (or other) geo-IP database of our own.

Security we actually operate

  • HTTPS in transit. Collect is POST JSON with a 2 KB body cap.
  • Hostname must belong to the site. Obvious bots and prefetch are dropped.
  • 60 beacons per hashed IP per minute, in Postgres so every isolate shares the quota. One IP flood: 204, no row. A busy site is not dropped.
  • HMAC pepper lives in environment config, not next to the pageview table. Daily salt is deleted.
  • Account passwords are hashed by Better Auth. Optional TOTP 2FA.
  • We do not claim ISO 27001, a pentest badge, or open-source audit theatre. The method page is the public description of the visitor hash.

Our obligations as processor

  • Process visitor data only to provide the dashboard and the script — your documented instructions are: install the snippet, collect pageviews and named events, show you the counts.
  • Keep visitor data confidential. Staff may see a site’s stats to fix the product or abuse, not to mine traffic.
  • Tell you without undue delay if we become aware of a personal-data breach affecting your visitor rows, and of any instruction that would break applicable law so far as we can see it.
  • Forward data-subject requests that clearly concern your site to you. We cannot identify a natural person from the daily digest once the salt is gone.
  • Not modify or delete your stats except on your action (filters in the UI do not rewrite history; site or account delete does) or where the law requires it.

Export and delete

You can export dashboard data and account JSON yourself. Deleting a site deletes its pageviews. Deleting the account deletes the sites you own. That is on /app/account — no sales call. Deletion is irreversible. We do not keep a side-copy of visitor rows “for analytics on analytics.”

We do not publish a multi-year retention clock. Rows stay while the site exists. The daily salt does not.

Your undertakings

  • Only send beacons for sites you control.
  • You decide lawfulness, notices, and whether your counsel wants a cookie banner. This script is built so a banner is not required for this tracker; that is not a legal opinion on your whole site.
  • Do not use the script to collect extra personal data (emails in query strings are dropped; do not stuff them in event names).
  • Public share links and team invites are your disclosure. Turn them off if they should not be public.

Duration

This DPA applies for as long as we process visitor data for you. It replaces any earlier visitor-processing terms between you and Cookie Free Analytics. Confidentiality survives. We may update this page; the date at the top is the version. Material changes to processing will also land on the changelog.

Operator

Cookie Free Analytics is the service at cookiefreeanalytics.com, operated by Prestons Creek Capital. KvK 42139404. VAT NL005528479B09. Questions: the account you already have, or the address on the mail we send you. There is no DPO named yet; we will not invent one.

Acceptance

Creating an account or sending a beacon from a site you added is acceptance of this DPA as an addendum to the Terms. No separate signature is required for Starter or Growth. Your counsel still owns the call for your organisation.