Privacy

What we keep. What we throw away.

Written so a non-lawyer can read it. The engineering version is the method page. The processing agreement for your visitors is the DPA.

On your visitors

We record that a page loaded: which site, which path (query stripped except five UTM tags), which referrer (origin + path, no query), a coarse country, region code, and city name from the edge, a browser family, and an optional event name you send. No coordinates, no postal code, no IP on the row. The beacon is POST JSON, so those fields are not sitting in CDN access logs. We do not set a cookie. We do not write to storage in the browser. We do not fingerprint.

To count one person once per day we briefly use the IP address, HMAC it with a server pepper and a daily salt we then delete, store only the 16-byte digest, and discard the IP. The next day the salt is gone. We cannot follow someone across days. The recipe is on the method page.

On you, the customer

An account is a name, email, and a password hash — or whatever the sign-in provider (Google, X) sends us. Sites you add: domain, name, plan, public id. We email about the product, not about your visitors. Export and delete are on /app/account. No sales call.

Google Search Console

Connect Google on the dashboard is optional. If you grant it, we read Search Console for the properties you pick: queries, pages, clicks, and impressions (read-only). That is shown to you on /app, next to your own pageviews. It is not mixed into visitor rows, not sold, not used for ads, and not used to train models.

Disconnect on the same dashboard, or in Google Account → Security → Third-party access. That stops new reads. Wiping the Cookie Free Analytics account is still /app/account.

The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Where it lives

No cookies, just insights. Made and hosted in the EU. Beacons hit Frankfurt; pageviews sit in Ireland Postgres. Vercel is a US company. We do not sell traffic data and we do not send it to an ads company. Sign-in with a third party is that third party’s processing, not a pageview export. Email and password sign-in, signup, and password reset may show a Cloudflare Turnstile challenge when the request looks like a bot — not on every attempt, and not Google reCAPTCHA. The pageview log never sees that check.

Grok on the dashboard

Period briefing and Set up this site run only if you click them. Then xAI (United States, Grok) sees dashboard aggregates and, for setup, the homepage title and a path list — not hashes, not IPs, not the pageview log. The note is stored in Ireland. Clicks are capped per account per day. The DPA says the same.

This site

cookiefree’s own marketing pages use the same script, with the badge off. No other analytics cookies. You can read the network tab.

What we will not build

Session replay, cross-site identity, a data marketplace. If a feature needs a second beacon to exist, it stays out.

Who holds the account data

For your customer account (name, email, password hash, billing), the controller is Prestons Creek Capital, KvK 42139404, VAT NL005528479B09. Visitor pageviews on sites you add are processed under the DPA: you are controller, we are processor.

Last updated 26 August 2026. Questions belong on the account you already have, or on the script page.