Staats

Privacy policy

Last updated: 1 September 2026

Staats provides website analytics. This policy covers two kinds of people: visitors to websites that use our tracking script, and customers who hold a Staats account.

If you're visiting a site that uses Staats

The tracking script is cookieless and stores nothing on your device. When you view a page, the site sends us: the page path, the referring domain, UTM campaign parameters if present, and any custom events the site has defined. From the request itself we derive your browser family, operating system, device type (desktop, mobile or tablet), and country.

If a script on the site fails, the site may also send us the error's message, source file path, and line number. Before storage the message is scrubbed of identifier shapes (email addresses, tokens and keys, card-shaped and other long numbers, UUIDs, IP addresses, and long quoted strings), truncated to 200 characters, and kept as a single sample per distinct error rather than per occurrence. This scrubbing is pattern-based and cannot recognise free-text personal information, which is why only one short truncated sample is retained, and it is deleted under the same retention rules as all other events. Each occurrence of an error is also counted as an event with the same fields as any other event (page path, device, browser, operating system, country, and the daily-rotating visitor identifier) so error frequency can be reported. Error events and samples are internal to the analytics and are not included in the CSV traffic export.

We do not collect or store your IP address. It is used transiently, in memory, to compute a pseudonymous visitor identifier (a one-way salted hash that changes every day) and is then discarded. Yesterday's identifier cannot be connected to today's, and no identifier can be reversed into who you are. We never use fingerprinting, we set no cookies, and we do not track you across websites.

Links you follow sometimes carry a click identifier appended by an ad network or a Meta app (such as gclid or fbclid). The tracker keeps only the network's name, and for ad-only identifiers that the visit was paid, then discards the identifier itself: it is never sent to us and never stored.

If you have a Staats account

We store the details your sign-in provider (Google or GitHub) shares at sign-in: your name and email address. We also store the sites you create, their API keys, the analytics data your sites collect, the annotations and context saved by you or your tools, and records needed for billing.

Our pages load fonts from Google Fonts. Those requests are made by your browser and share your IP address with Google. They apply to you as a visitor of our own pages — never to visitors of your sites.

Where data lives and how long it's kept

Data is stored with Supabase in the European Union (Frankfurt, Germany). Analytics events are deleted automatically after your plan's retention period, from 30 days on the free tier up to 3 years on paid plans; site owners can shorten this per site. Account data is kept while your account exists and is deleted when your account is.

What we don't do

Your rights

You can request access to, correction of, or deletion of your personal data at any time. Site visitors should note we generally cannot identify individual visitors in analytics data; that is the core point of the design.

Contact

Questions or requests: support@staats.ai