Privacy behaviour

This page describes Antlytics's product behaviour, not legal compliance status. Whether Antlytics meets your specific compliance obligations depends on your jurisdiction, your implementation, and other tools on your site. Consult your legal adviser for advice specific to your situation.

What Antlytics collects

For each pageview, Antlytics records:

Field	What it is
Pathname	The URL path of the page, for example `/blog/my-post`. Query strings and hashes are included in the raw event but the hash is not used for matching.
Referrer	The referring URL reported by the browser, if present.
Session ID	A UUID generated per-tab using `sessionStorage` (see below).
UTM parameters	`utm_source`, `utm_medium`, `utm_campaign`, `utm_content`, `utm_term` if present in the page URL.
Country	Derived from the visitor's IP address at the time of the request. Only the country code is stored — not the IP address itself.
Device type	Desktop, mobile, or tablet, derived from the User-Agent header.
Browser	Derived from the User-Agent header.
Operating system	Derived from the User-Agent header.

Engagement signals (when enabled)

If your site uses the current tracker or SDK, Antlytics also records per-pageview engagement signals:

Field	What it is
Scroll depth	The maximum percentage of the page the visitor scrolled, sent as the visitor leaves the page.
Time on page	Milliseconds of active time on the page, sent as the visitor leaves the page.

Custom events (when you send them)

If you call Antlytics.track('event_name', { ...props }), the event name and the properties you pass are stored alongside the standard pageview fields. You control what goes in event properties — do not include names, email addresses, or other personal identifiers.

What Antlytics does not collect

Identity cookies — The tracker does not set cookies for visitor identity, sessions, or advertising. Visit continuity uses sessionStorage only. The optional Exclude my visits control in Settings → Shields sets a first-party antlytics_exclude=1 cookie on your browser so your own traffic is not recorded — it is not used for visitor identity. Account-wide IP blocks live under Settings → Exclusions and apply to every site you own.
Stored IP addresses — Client IP is used at ingest for country lookup, rate limits, shields, bot signals, and the daily unique-visitor hash, then discarded. It is not stored on the event row.
Cross-site tracking — Antlytics tracks visitors only on sites that have explicitly installed the Antlytics tracking script. There is no cross-site identity.
Fingerprinting — Antlytics does not use canvas fingerprinting, font fingerprinting, or any other technique that would uniquely identify a visitor across sessions.
Personal data — No names, email addresses, phone numbers, or other personal identifiers are collected by the tracker.

How sessions work

Visit continuity within a single browsing tab uses a UUID in sessionStorage, with a 30-minute idle timeout (industry-standard visit window):

A new tab or window gets a new visit ID
30 minutes without tracked activity mints a new visit ID
Closing the tab clears sessionStorage — it does not persist across browser restarts
Visit IDs are not shared between tabs

This is enough to calculate bounce rate and visit metrics without a cookie-based returning-user identity.

Visits and unique visitors

Antlytics does not use cookies for identity. Two privacy-preserving layers:

Visits — tab-scoped session_id in sessionStorage, with a 30-minute idle timeout. A new tab (or 30 minutes idle) is a new visit.
Unique visitors — a daily salted HMAC of IP + User-Agent + site (IP discarded after hashing). Same person tomorrow or on another device counts as a new unique visitor. No reversible identifier is stored.

REST/MCP fields named visitors (and often sessions) mean visits for compatibility. Prefer unique_visitors on MCP / dashboard KPIs when you need the hash-based count. See Dashboard overview.

Third-party processors

Antlytics uses the following third-party services for its own operation:

Processor	Purpose
Clerk	Authentication and user management
Supabase	Database for storing analytics events and account data
Stripe	Payment processing for paid subscriptions
Vercel	Application hosting and edge network (processes requests in transit)
Resend	Transactional email (weekly summaries, usage alerts, receipts)
Upstash	Rate limiting and optional bot-filter counters (no analytics event payloads)

Each processor handles data under its own privacy policy. Antlytics analytics data is not shared with these processors for their own purposes.

AI providers (bring your own key)

If you connect an AI provider for AI Page Insights, the provider you choose (Anthropic, OpenAI, Google, OpenRouter, or an OpenAI-compatible endpoint) receives aggregate page statistics only — pageview counts, referrers, and engagement metrics for the page you request insights for. No raw visitor data leaves Antlytics. Your API key is stored encrypted (AES-256-GCM) and can be removed at any time from Settings → AI. If you never connect a key, no data is sent to any AI provider.

Compliance positioning

Antlytics is designed so that its default tracking configuration does not use identity cookies, does not store IP addresses on events, and does not store personal data. This design may reduce your compliance overhead in some jurisdictions — for example, tools that do not use tracking cookies may not require a cookie consent banner in some regulatory frameworks.

This is not legal advice. Regulatory requirements vary by jurisdiction, by the type of data you collect, and by other tools on your site. Consult your legal adviser to confirm your obligations.

Bot filtering

Client IP is used at ingest for rate limits, shields, and bot signals, then discarded — it is not stored on the event row. See Bot filtering.