Privacy
What leaves your site, and what never does.
The script runs in the browsers of people who have never heard of us. The unit measured is one page view, never a person — and there is no identifier in this system that could make it one tomorrow.
Exactly what one payload contains
One row is one page view. The visitor it came from is a hash of the day's secret, the IP address, the User-Agent and the site id — and that secret is replaced every night and the old one destroyed, so the same person on two consecutive days produces two values nothing can connect.
Sent
- The page path: query string dropped, segments shaped like an identifier replaced with « :id », truncated.
- The five `utm_*` campaign parameters, when the visited link carried them. Read by name, never by pattern: every other query parameter is dropped before anything is sent.
- The referrer's origin, when the browser sends one.
- The country, resolved from the IP address and stored instead of it.
- Coarse device and browser family — the categories a report is drawn from, not a fingerprint.
- The timestamp of the view.
- A visitor hash that is valid for one day and cannot be recomputed after that night.
Never sent, and never stored
- No cookie, and no write to localStorage, sessionStorage or IndexedDB.
- No IP address. It is used to compute the daily hash and to resolve a country, then discarded — there is no column to store it in and no log line that contains it.
- No persistent identifier: no account, no device id, no random token, nothing that outlives the night.
- No query string, apart from the five `utm_*` names above: it is dropped, not truncated, because that is where session tokens live. A closed list of five literal names cannot widen by accident, and a reset token sharing a URL with a campaign does not travel with it.
- No page content, and nothing a visitor typed.
How long it is kept
The history window is what the plan buys, and it is the same number that drives the server-side retention pass.
- Starter
- 30 days of history
- Growth
- 180 days of history
- Scale
- 13 months of history
The window is enforced by the process on a schedule, not by a policy somebody has to remember. Data past it is deleted whether or not anyone is watching.
Data protection officer
This question has not been answered yet, and saying so is the only honest thing this page can do. The product this repository was forked from carried a reasoned « not required », and that reasoning turned on collecting no visitor identifier at all — which is not quite what Panel does. Whether a daily-rotating hash whose secret is destroyed each night amounts to « regular and systematic monitoring of data subjects » under Art. 37(1)(b) is exactly the question an assessment exists to settle, and inheriting somebody else's conclusion would be a decision nobody made wearing the authority of one somebody did.
- Not a public authority — Art. 37(1)(a) does not apply.
- No special-category data and nothing about criminal convictions — Art. 37(1)(c) does not apply.
- Art. 37(1)(b) is the open question, and it is open because of the daily visitor hash rather than in spite of it.
- The day the assessment is made, it is written down with its reasoning and the conditions that would reverse it, and this page changes with it.
Data controller
A privacy policy has to name its data controller and the competent supervisory authority. Those fields are not filled in yet, and they are shown as such rather than hidden.
- Data controller
- Not published
- Postal address
- Not published
- Exercising your rights
- Not published
- Supervisory authority
- Not published
- DPO contact
- Not published