Privacy Policy & Promise
Last updated: September 9, 2026. Effective immediately for all visitors and customers.
The VeloStats Privacy Promise
VeloStats was engineered on a simple principle: you should never have to sacrifice visitor privacy to understand how your website performs. We pledge to uphold the following standards across every product and service we offer:
Zero Cookies or Device Fingerprinting
We never write to cookies, localStorage, indexedDB, or generate persistent hardware device fingerprints.
Zero IP Address Storage
IP addresses are strictly ephemeral in-memory inputs. They are never written to disk, database tables, or access logs.
Daily Rotating Salt
Daily visitor hashes rotate every 24 hours using cryptographic salts, making cross-day and cross-site tracking mathematically impossible.
No Consent Banners Needed
Because no personal data is stored, VeloStats complies natively with GDPR, ePrivacy (PECR), and CCPA without cookie popups.
1. Overview & Scope
This Privacy Policy describes how VeloStats ("we", "us", or "our") processes data in connection with:
- Our Website & Customers: Individuals and organizations who register an account, configure sites, and use our dashboard.
- End-User Website Visitors: Individuals who browse websites that integrate the VeloStats tracking script (
velo.js).
2. Analytics Tracking & Visitor Data Processing
When a visitor navigates a website powered by VeloStats, our client script transmits lightweight telemetry pings to our ingestion endpoint. Here is precisely how this data is handled:
A. Ephemeral IP Processing
The visitor's IP address is received by our application purely in volatile server memory (RAM) for three strict purposes:
- Geographic Resolution: Translating the IP to a coarse geographical entity (country, region, city) using a local GeoIP database. Latitude, longitude, and street-level addresses are never determined or stored.
- Network Classification: Looking up the Autonomous System Number (ASN) to classify automated crawlers, datacenter bots, and search engines.
- Salted Hashing: Producing a pseudonymous daily hash (
HMAC-SHA256) with a rotating secret key.
Once these three in-memory operations complete (in < 5 milliseconds), the raw IP address is discarded. It is never logged or inserted into persistent database storage.
B. Pseudonymous Daily Visitor IDs
To distinguish unique human visits from repeat pageviews within the same day without cookies, VeloStats generates a one-way cryptographic hash:
visitor_id = HMAC_SHA256(raw_ip + user_agent + viewport_dims + daily_salt)The secret salt rotates every 24 hours. Because the salt is rotated and never archived with old logs, it is mathematically impossible to link visits across different calendar days or re-identify individuals across different websites.
C. Metrics & Telemetry Collected
- Page Information: URL path, document title, and HTTP referrer domain.
- Device Context: Operating system, browser family, viewport width and height, and screen category.
- Core Web Vitals: Largest Contentful Paint (LCP), Interaction to Next Paint (INP), and Cumulative Layout Shift (CLS).
- Session Lifecycle: Duration on page, scroll depth milestones, and heartbeat pings to verify genuine human engagement.
3. Customer Account Information
When you register as an account owner or administrator on VeloStats, we collect:
- Contact Details: Your email address, used for login, account verification, and critical service notices.
- Authentication Credentials: Passwords are cryptographically salted and hashed using industry-standard cryptographic hashing algorithms. We cannot read or recover plaintext passwords.
- Site Configurations: Domain names, site keys, public dashboard share tokens, and notification webhooks.
You can permanently delete your account and all associated site data at any time via the Danger Zone in Account Settings. Deletion cascades immediately and irrevocably across all database tables.
4. Sub-Processors & Infrastructure
We partner with trusted infrastructure providers who adhere to strict security and privacy standards:
| Provider | Role / Purpose | Data Transferred | Location |
|---|---|---|---|
| Cloudflare | Edge DNS, DDoS protection, and Turnstile bot protection on auth forms | Network-level request headers | Global Edge |
| Resend | Transactional email delivery (email verification, password reset) | Account owner email addresses | United States |
| Primary Hosting Infrastructure | Self-hosted primary application and database infrastructure | De-identified beacon events and customer settings | Secure Colocated Datacenter |
5. Data Retention
We enforce strict automated data lifecycle policies:
- Raw Event Telemetry: Stored in partitioned, compressed database tables. Old records are automatically dropped after 90 days.
- Aggregated Rollups: Hourly and daily statistical summaries (aggregate pageview counts, device breakdowns) are retained long-term to power historical charts without storing granular visit details.
- Session Authentication Tokens: Revoked or expired refresh tokens are automatically purged on a daily automated schedule.
6. Your Rights Under GDPR, CCPA, and Global Privacy Laws
Under global privacy frameworks (including GDPR, UK GDPR, and California CPRA), users have rights regarding access, rectification, erasure, and portability of their personal data:
- For Website Visitors: Because VeloStats does not store personal data or persistent identifiers, we cannot correlate a specific individual to historical beacon rows. Therefore, visitor data is inherently anonymous and exempt from individual data access/deletion requests.
- For Account Customers: You may review, export, update, or permanently delete your account data at any time directly through your dashboard.
7. Contact Information
If you have questions, feedback, or concerns regarding this Privacy Policy or our privacy architecture, please contact our privacy team: