Privacy Policy

1. Who this policy covers

This policy applies to two groups:

• Account holders — people who sign up for a StatsNGraphs account to track their own websites.
• End-user visitors — people who visit websites that have embedded the StatsNGraphs tracking snippet. We act as a data processor on behalf of the account holder for this group.

2. Data we collect from account holders

• Email address — used for magic-link authentication and transactional emails (e.g. sign-in links, billing receipts).
• Session data — a signed, server-side session cookie that keeps you logged in. It contains no personal identifiers beyond your internal user ID.
• Billing information — payment details are handled entirely by Lemon Squeezy. We store only your subscription status and plan tier.
• Usage data — the sites you add, saved views, goals, and event rules you configure.

3. Data we collect from end-user visitors (via the tracking snippet)

When visitors browse a site that uses StatsNGraphs, our snippet collects:

• IP address — used solely to derive an approximate country/region via a locally-run database (MaxMind GeoLite2). The raw IP is never written to disk or stored in our database.
• Page URL and referrer — to record pageviews and traffic sources.
• UTM parameters — utm_source, utm_medium, and utm_campaign tags present in the URL.
• User-agent string — parsed to derive browser name, OS, and device category (desktop / mobile / tablet). The raw user-agent is not stored.
• Custom events — any events the site owner instruments via window.sng.track(). Site owners are responsible for ensuring no sensitive personal data is passed in event payloads.
• Session engagement signals — a 10-second on-page timer used to mark engaged visits. Bounce rate is calculated from single-pageview sessions. No keystrokes, form input, or clicks outside tracked elements are recorded unless you configure an event rule.

We do not set any cookies on end-user browsers. Visitor tracking is session-based and does not fingerprint or re-identify individuals across sites.

4. How we use data

• To provide analytics dashboards, charts, and insights to account holders about traffic on their own sites.
• To authenticate account holders and maintain sessions.
• To send transactional emails (sign-in links, billing notifications, optional weekly analytics digests). We do not send marketing emails without your explicit opt-in.
• To process payments and manage subscriptions through Lemon Squeezy.
• To monitor service health and debug issues.

We do not sell, rent, or share personal data with third parties for advertising or marketing purposes.

5. Third-party services

• Lemon Squeezy (privacy policy) — payment processing and subscription management. They receive your email and payment details when you purchase a paid plan.
• Resend (privacy policy) — transactional email delivery. They receive your email address and the content of emails we send you.
• MaxMind GeoLite2 (privacy policy) — IP-to-country geo-lookup database, run locally on our servers. No data is transmitted to MaxMind at runtime.

6. Data retention

• Account data and analytics data are retained for as long as your account is active.
• When you delete a site, all analytics data for that site is permanently deleted.
• When you delete your account, all associated data (sites, analytics, saved views, goals) is permanently deleted within 30 days.
• Billing records may be retained for up to 7 years as required by law.

7. Security

All data in transit is protected by TLS. Sessions are signed with a server-side secret. We follow industry-standard practices including rate limiting, input validation, and HTTP security headers. No system is perfectly secure, but we take reasonable precautions to protect your data.

8. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data ("right to be forgotten").
• Object to or restrict processing.
• Data portability (receive your data in a machine-readable format).

To exercise any of these rights, email us at hello@statsngraphs.lol. We will respond within 30 days.

9. Cookies

StatsNGraphs uses one first-party cookie:

• auth — a signed session cookie set only when you log into your StatsNGraphs account. It expires after 30 days of inactivity. It is HttpOnly, Secure in production, and SameSite=Lax.

The tracking snippet we provide to embed on your site does not set any cookies on your visitors' browsers.

10. Children's privacy

StatsNGraphs is not directed to children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

11. Changes to this policy

We may update this policy from time to time. We will post the updated policy on this page with a revised "last updated" date. For material changes, we will notify account holders by email. Continued use of the service after a change constitutes acceptance of the updated policy.