Privacy Policy

FocusStat is a web analytics service. This policy explains what data we handle, why, and what rights you have. It covers two groups of people: account holders (people who sign up and use the FocusStat dashboard) and website visitors (people who browse websites that use FocusStat tracking). We wrote it to be readable; if anything is unclear, contact us at admin@focusstat.com.

The short version

• We measure website usage without identifying individual people.
• We do not use advertising trackers, sell data, or build cross-site profiles. Ever.
• Visitor IP addresses are used transiently for coarse location and immediately discarded, never stored.
• No browser fingerprinting. Visitor identifiers are random, per-website, and never shared between websites.
• Session replays mask passwords and all typed input before anything leaves the visitor's browser.
• Website owners can delete their data at any time: per visitor, per replay, or everything.

Data we process about website visitors

When you visit a website that uses FocusStat, its tracking script collects usage information on behalf of that website's owner:

• Pages and interactions: pages viewed, referring site, clicks on interactive elements, scroll depth, time actively spent, and custom events the website owner defines (e.g. "signup completed").
• Technical context: browser and version, operating system, device type, screen size, language, and timezone, all from standard browser headers, not fingerprinting.
• Coarse location: country, region, and city derived from the IP address by our hosting provider's edge network. The IP address itself is never stored.
• Reliability data: JavaScript errors, failed resources, and performance timings (Core Web Vitals), so site owners can fix what is broken or slow.
• Session replays (only if the site owner enables them): a recording of page structure and interactions for a sample of visits. Passwords, form inputs and any content the site owner marks as sensitive are masked in the browser before the recording is transmitted. Replays are stored encrypted at rest, access-controlled, and auto-deleted per the site's retention setting.

A random identifier is stored in the visitor's browser storage so returning visits to the same website can be counted. It contains no personal information, is different for every website, and is never used to follow anyone across the web. Websites can also run FocusStat in cookieless mode, where no persistent identifier is stored at all.

The tracker honors opt-outs: analytics.optOut(), and, where the website enables it, the Do Not Track and Global Privacy Control browser signals.

Data we process about account holders

• Account data: your email address and a securely hashed password, used solely for authentication and service communication.
• Configuration: the sites, goals, funnels and settings you create.
• Service usage: we may measure usage of FocusStat itself with FocusStat (dogfooding), under the same rules described above.

AI features

FocusStat's AI Analyst explains changes in your analytics. All statistics are computed by FocusStat first; only aggregated, non-personal summaries (for example: "mobile sessions: 842, conversion 2.7%, previously 3.8%") are sent to an AI provider to generate explanations. Raw events, session recordings, IP addresses, visitor identifiers and personal information are never sent to AI providers.

Where data lives and who touches it

Data is stored with our infrastructure providers (currently Supabase for the database and file storage, Vercel for hosting and edge delivery), and aggregated summaries may be processed by an AI provider (currently OpenAI) as described above. These providers process data on our instructions. We do not sell or rent any data to anyone, and we do not share it with advertisers or data brokers.

Roles and responsibilities

For visitor analytics we act as a processor on behalf of the website owner, who is the controller of their site's analytics data and is responsible for their own legal disclosures to their visitors. For account-holder data we act as the controller.

Retention and deletion

• Website owners choose retention windows for raw events (90/180/365 days or unlimited) and replays (7-90 days); expired data is deleted automatically.
• Website owners can delete a single visitor's data, a single replay, all analytics for a site, or the site itself; deletions include stored replay files.
• Account deletion: contact us and we will remove your account and its data.

Your rights

Depending on where you live (e.g. GDPR in the EU, CCPA in California), you may have rights to access, correct, delete, or export data about you. Account holders can exercise most of these directly in the dashboard. Website visitors should contact the owner of the website they visited (the data controller); if you contact us instead, we will help route the request. Reach us anytime at admin@focusstat.com.

Changes

If we change this policy, we will update the date at the top. Material changes will be announced in the dashboard.