Analytics Data Policy

Last updated: July 10, 2026

1. What this covers

Taprun provides privacy-first website analytics: a small script that websites built with or connected to Taprun include to count visits. This page describes exactly what that script collects about a website’s visitors. It applies to any site carrying our tracking snippet, including our own.

2. What we never collect

No cookies, and nothing stored in your browser
No IP addresses — never stored, hashed, or written to our application logs
No fingerprinting and no cross-site or cross-visit identity
No names, emails, or account data — the script has no idea who you are
No full URLs: query strings are discarded in your browser before anything is sent (only utm_* campaign tags — and a bare ref= parameter, stored as the campaign source — survive), and page anchors are never sent

Because nothing identifies a person and nothing is stored on the device, sites using this analytics do not need a consent banner for it under GDPR/ePrivacy.

3. What a pageview records

The page’s path (never query strings or anchors)
The referring site (external referrers only, reduced to host and path — internal navigation never leaves your browser)
utm_* campaign tags, when present in the link you followed
Your device’s IANA timezone (for example Europe/Warsaw), which is how we derive a country-level location — we never use your network address for geography. The timezone string itself is retained alongside the derived country so historical data can be re-mapped when timezone databases change; it is region-level information, and no finer location is ever derived from it.
Browser language (for example en-US)
Viewport and screen size
Browser name, major version, operating system, and device class (desktop / mobile / tablet), parsed from the user-agent header, which is then discarded — the raw user-agent string is never stored
Two random identifiers that exist only for the lifetime of the page you are on (they are regenerated on every full page load, are never saved to your device, and cannot connect two separate visits)

“Unique visitors” are estimated statelessly from the referrer of each landing — an approximation that requires no identifier at all. A returning visitor may be counted again.

4. Custom events

Sites may report named events (for example signup_clicked) with small, flat metadata. Site owners are instructed not to place personal data in event metadata, and the pipeline enforces strict shape and size limits on it.

5. Retention and deletion

Individual pageview records are kept for up to 90 days on a rolling basis; only aggregate statistics (daily totals) are kept beyond that. Deleting a tracked site deletes its analytics data with it.

6. Who is responsible

For websites our customers run, the site owner is the data controller of their visitor statistics and Taprun processes the data on their behalf, under this policy. For taprun.ai itself, Taprun is the controller. Transport-level server logs kept by our hosting providers (which, like all web infrastructure, briefly include network addresses) are outside the analytics pipeline and are never joined with it.