Privacy Policy

OpenMetrica ("we", "us", "our") operates the openmetrica.com website and the OpenMetrica analytics platform. This Privacy Policy explains how we collect, use, and protect information when you use our services.

We are committed to protecting your privacy and the privacy of your website visitors. OpenMetrica is designed from the ground up to be privacy-friendly and fully compliant with GDPR, CCPA, and other privacy regulations.

We collect minimal information necessary to provide our services:

• Your account email address, an optional name and your password (hashed)
• Billing information processed securely through Stripe
• Website URLs you add to your dashboard
• The IP address and browser of each of your logins, kept with the session so that you can review and revoke it
• A security audit log of actions in your account, and the email addresses of people you invite
• Usage data about how you interact with our platform

For visitors to websites using OpenMetrica tracking, we process the following:

• Page URL and referrer URL
• Browser type and operating system (non-identifying)
• Country-level geolocation (derived from IP, which is never stored)
• Screen size category (mobile, tablet, desktop)
• The IP address and User-Agent of each request, used at ingestion and not stored, from which we derive two one-way values, a daily visitor hash and a 90-day funnel pseudonym
• The time of each pageview or event, UTM parameters, and the names and properties of the custom events a site sends

Our own website, openmetrica.com, counts its visitors with OpenMetrica in the same way. Its pages load the tracking script from openmetrica.com itself, and its visits are processed exactly as described above for visitors to websites using OpenMetrica tracking.

OpenMetrica is built on a strict no-personal-data principle:

• The tracking script uses no cookies and no local storage
• We do not store the IP addresses of your visitors
• We do not fingerprint the browser (the tracker reads no canvas, fonts, screen or hardware details) and we do no cross-site tracking
• We do not collect names, email addresses or account identifiers of your visitors
• We do not sell data. The service providers we use are listed in our Data Processing Agreement
• We do not use data for advertising purposes

Visitor analytics data is processed and stored exclusively on servers located within the European Union (Germany and Finland), and we do not transfer it outside the EU/EEA. The providers we use for payments and email are listed in our Data Processing Agreement, with the safeguards that apply to them.

We use industry-standard encryption (TLS 1.3) for all data in transit and AES-256 encryption for data at rest. Our infrastructure runs in ISO 27001 certified data centres operated by Hetzner Online GmbH, which is also named as a sub-processor in our Data Processing Agreement.

Retention does not depend on your plan. It is the same on Free, Starter, Growth and Business:

• Aggregated statistics, which is everything the dashboard charts and tables are built from: 25 months
• The raw event log behind goals and funnels, one row per pageview or custom event with the two one-way visitor values, a random identifier of its visit, the visit's source and UTM tags, and the country, device type, browser and operating system of the request: 12 months
• The per-pageview rows the statistics are built from: 7 days
• Historical data you import yourself: 5 years
• The random salt that makes a day's visitor hash computable: discarded within 48 hours

Account data is retained as long as your account is active. Deleting a site starts the erasure of that site's analytics data. Upon account deletion, your account is removed and the erasure of its sites' analytics data starts, to be completed within 30 days. Entries of the security audit log are kept without your user id, and billing records stay with Stripe.

Under GDPR and applicable privacy laws, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate personal data
• Request deletion of your personal data
• Export your data in a portable format
• Object to or restrict processing of your data
• Withdraw consent at any time

To exercise any of these rights, contact us at privacy@openmetrica.com.

The OpenMetrica tracking script does not use cookies, and neither does our website (openmetrica.com). The dashboard keeps your login tokens and preferences in your browser's local storage. We do not use any third-party cookies, advertising cookies, or analytics cookies on our own website.

We may update this Privacy Policy from time to time. We will notify you of any material changes by email and by posting the updated policy on our website. Your continued use of the service after changes constitutes acceptance of the updated policy.