Privacy

What we keep. What we throw away.

Written so a non-lawyer can read it. The engineering version is the method page. The processing agreement for your visitors is the DPA.

On your visitors

We record that a page loaded: which site, which path (query stripped except five UTM tags), which referrer (origin + path, no query), a coarse country, region code, and city name from the edge, a browser family, and an optional event name you send. No coordinates, no postal code, no IP on the row. The beacon is POST JSON, so those fields are not sitting in CDN access logs. We do not set a cookie. We do not write to storage in the browser. We do not fingerprint.

To count one person once per day we briefly use the IP address, HMAC it with a server pepper and a daily salt we then delete, store only the 16-byte digest, and discard the IP. That digest is still personal data. The next day the salt is gone. We cannot follow someone across days. We do not call the hash anonymous. The recipe is on the method page.

On you, the customer

An account is a name, email, and a password hash — or whatever the sign-in provider (Google, X) sends us. Sites you add: domain, name, plan, public id. We email about the product, not about your visitors. Export and delete are on /app/account. No sales call.

Google Search Console

Connect Google on the dashboard is optional. If you grant it, we read Search Console for the properties you pick: queries, pages, clicks, impressions, CTR, and position (read-only). That is shown to you on /app, next to your own pageviews. It is not mixed into visitor rows, not sold, not used for ads, and not used to train models.

Disconnect on the same dashboard, or in Google Account → Security → Third-party access. That stops new reads. Wiping the Cookie Free Analytics account is still /app/account.

The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Stripe (your account)

Connect Stripe on the dashboard is optional. If you grant it, we read successful charges and Checkout metadata you already stored (read-only). Totals and, when present, the five UTM tags show on /app for the same range as the board. That is your Stripe account, not a hostname. It is not mixed into visitor rows, not sold, not used for ads, and not used to train models. We do not store customer emails, card numbers, or names from that read.

Disconnect on /app/account, or in Stripe → Connected apps. That stops new reads. Cookie Free Analytics’ own billing Stripe (Starter and Growth invoices) is a separate integration.

Where it lives

No cookies, just insights. Made and hosted in the EU. Beacons hit Frankfurt; pageviews sit in Ireland Postgres. Vercel is a US company. We do not sell traffic data and we do not send it to an ads company. Sign-in with a third party is that third party’s processing, not a pageview export. Email and password sign-in, signup, and password reset may show a Cloudflare Turnstile challenge when the request looks like a bot — not on every attempt, and not Google reCAPTCHA. The pageview log never sees that check.

Watch

If you turn Watch on, you instruct us to request a URL on a hostname you already added as a site. We store the URL, status code, timings, TLS expiry, whether DNS answered, and incident timestamps. We do not store the response body, the target’s server logs, or visitors. Raw checks are kept 7 days, then rolled up. You can pause or remove a monitor. Recipe: /docs/watch.

Grok on the dashboard

Period briefing and Set up this site run only if you click them. Then xAI (United States, Grok) sees dashboard aggregates and, for setup, the homepage title and a path list — not hashes, not IPs, not the pageview log. The note is stored in Ireland. Clicks are capped per account per day. The DPA says the same.

AI apps and MCP

You can connect an AI app (Grok, Cursor, Claude and others) to https://www.cookiefreeanalytics.com/mcp. It signs in with OAuth 2.1 on this site and only after you click Allow. With the analytics:read permission it can read the same aggregates as your dashboard (visitor, visit and pageview counts, top pages, sources, Watch status) and your sites’ tracking code. With sites:write it can add a website to your account; it cannot change or delete anything. It never receives visitor hashes, IP addresses or the pageview log. We store the app’s name, its redirect address and hashed tokens (1 hour access, 30 days refresh), plus a daily call count. Whatever the app receives is then processed by that app’s provider under their terms. Disconnect an app any time under Account → Connected apps; deleting your account removes all of it. We don’t use MCP data or your content to train models, and we don’t sell it.

This site

cookiefree’s own marketing pages use the same script, with the badge off. No other analytics cookies. You can read the network tab.

Site Check (Chrome extension)

Site Check by Cookie Free Analytics shows which cookies and trackers the tab you open sets before and after you reject its cookie banner, plus basic SEO and tag details. It reads that page only when you click the extension icon. Chrome permissions (version 1.1.7): activeTab, scripting, storage, and browsingData, plus host access to www.cookiefreeanalytics.com only. No webRequest, no cookies permission, no broad host access, no remote code.

Auto-reject is on by default (switch it off in the popup). When a known consent tool’s own Reject button is open, Site Check clicks it, or calls that tool’s reject function, and checks the page again. It never clicks Accept. Reset site uses browsingData to clear cookies, storage, and cache for the current site only, then reloads the tab. It never clears history, downloads, passwords, or other sites.

On your device: the page report, your language, your switches, and the before-and-after scan for this browsing session. JSON and PDF downloads stay on your device.

Sharing is optional and off by default. Nothing leaves your device unless you turn on “Share proven findings” in the popup. When it is on and a scan proves a known tracker was contacted after you rejected, the extension sends one POST to https://www.cookiefreeanalytics.com/api/site-check/post-reject, without cookies, containing: the page address (origin and path only; no query string, fragment, or login details), the host, the scan times, how the reject was recorded, the names of new cookies (never their values), the names and hosts of the trackers contacted, which tools fired on each path, and the extension version.

We use these findings only to document tracking that continues after a visitor rejects, for example in a private evidence note to that site’s owner. A finding describes the website, not you. We do not sell it and do not use it for ads, profiling, or credit decisions. To limit abuse, the server uses a short hash of the sender’s IP address as a rate-limit key that is pruned after about two hours; no IP is stored with the finding. Findings are kept until deleted: email hello@cookiefreeanalytics.com to ask. To stop sharing, turn the switch off or remove the extension.

Questions: hello@cookiefreeanalytics.com.

What we will not build

Session replay, cross-site identity, a data marketplace. If a feature needs a second beacon to exist, it stays out.

Who holds the account data

For your customer account (name, email, password hash, billing), the controller is Prestons Creek Capital, KvK 42139404, VAT NL005528479B09. Visitor pageviews on sites you add are processed under the DPA: you are controller, we are processor.

Last updated 27 October 2026. Questions: hello@cookiefreeanalytics.com. Method: the script page.