Data & Privacy

100% cookieless by design, no personal identifiers collected, GDPR-ready out of the box, and every pageview and custom event exportable as CSV.

How visitors are counted

There are zero cookies, zero localStorage entries, and no persistent device identifiers. Every recorded event carries a pseudonymous visitor hash generated from the visitor's IP address, User-Agent header, current date, and a rotating cryptographic salt. This hash rotates daily at midnight UTC to prevent cross-day user profiling. The IP address itself is evaluated strictly in memory and is never written to disk.

Country inference without IP geolocation

Visitor country is derived entirely from the browser's IANA timezone (e.g. Europe/Berlin → DE) mapped against standard open timezone tables. No IP addresses are shared with third-party geolocation databases.

What to tell your visitors

Cookieless means there is no consent banner to show. It does not mean there is nothing to say: data protection law still expects you to mention analytics in your privacy notice, and one short paragraph covers it. Wording you can paste:

This site uses Staats (staats.ai), a cookieless analytics service, to
understand how the site is used in aggregate. It sets no cookies, stores
nothing on your device, and never records your IP address, which is used
only transiently to count unique visitors and is then discarded. No
identifier persists beyond 24 hours and you are not tracked across
websites.

Business customers are covered by a data processing agreement automatically: it is part of the terms of service.

Plans, quotas, and data retention

Daily agent requests are the MCP tool calls made against your account's data, by you and your team together. The allowance resets at midnight UTC. An interactive session uses a few dozen of them, so it exists to keep runaway automation bounded rather than to meter ordinary work. When a day's allowance is spent, tools decline with a note saying so until the reset. Calls against a site shared with you draw on that site owner's allowance, and guests together can use at most half of it, so an owner always keeps a working share of their own account. Portfolio views, which span several owners at once, draw on yours.

Event quotas feature a 25% soft buffer: collection continues smoothly past 100% and only pauses at 125% of your allowance until the month resets. The error allowance works the same way, with its own separate 25% buffer, and error events never count toward your event quota. Proactive notices appear in dashboard and MCP responses from 80% usage. Historical events past your plan retention window are cleaned nightly.

Sites that keep sending large volumes of traffic after collection has paused are turned away at the network edge until the month resets or the plan grows enough to resume. Nothing already collected is affected, and a traffic spike that settles down never triggers this: it exists for tags left running on sites whose traffic vastly exceeds their plan, where every request is refused anyway.

Error data

The tracker also records uncaught JavaScript errors on every plan. Messages are scrubbed of identifier shapes (emails, tokens and keys, long numbers, UUIDs, IP addresses) before storage, truncated to 200 characters, and kept as one sample per distinct error rather than per occurrence. No stack traces are collected. Error records follow the same retention rules as events and are permanently removed when a site is deleted.

Data export

Export all historical traffic events (pageviews and custom events) for any site at any time as clean, structured CSV files directly from your dashboard. Error records are analytics-internal and not included in the export.

Immediate deletion & data sovereignty

Deleting a site immediately and permanently purges all associated events and deploy annotations. Deleting an account cancels any active subscription and permanently removes all sites, keys, and event history.