No cookies. No personal data in analytics.

Analytics

No cookies, nothing stored on your device, no personal data. Endpoints: POST /_care/event, POST /_care/event/<name>, GET /_care/script.js.

What a request carries:

• the event name (for example "pageview" or "signup")
• the page address, of which only the site name (host) and the path are kept (query strings and #fragments are dropped, except utm_source, utm_medium and utm_campaign; ref or source stands in for a missing utm_source). A part of the path that looks like an email address is replaced by ":email", and such a utm value is dropped
• the referring site, of which only its host name is kept (for example "google.com")
• the screen width (to tell phone, tablet and desktop apart) and the browser language
• optional event properties set by the app, which must not contain personal data: names or values that look like an email address, and values that look like a browser User-Agent or an IP address, are refused
• on a page that runs an experiment, which version of the page was shown, for the whole page view

Used for a moment, never written:

• the IP address and the browser identifier (User-Agent), only in memory, to make a visitor code and to rate-limit; they are never written anywhere
• the country, from the network provider (Cloudflare) header

A visitor is counted with a code made from a random value that changes every day (UTC) plus the IP address and browser identifier. The random value is deleted at the end of the day, after which the code cannot be traced back to anyone or matched with any other day. So the same person on two days counts as two visitors; nobody is followed across days or across sites.

Never stored:

• IP addresses
• User-Agent strings
• cookies or device identifiers
• names, email addresses or account ids
• query strings and fragments of page addresses
• fingerprints

Events are deleted after 750 days.

Feedback, bug reports, messages and waitlist

Endpoints: POST /_care/feedback, POST /_care/bug, POST /_care/message, POST /_care/waitlist, GET|POST /_care/unsubscribe.

Feedback, bug reports, messages and waitlist signups keep what the person wrote, including an email address if they gave one (a contact message and a waitlist signup need one, to answer). Nothing is added from the device beyond the site (host) it was sent from, the browser name, operating system, device type, country and language. The IP address is not stored. Email addresses are stored encrypted (AES-256-GCM), with a keyed hash to find them for an erasure or export request. Every waitlist signup can be removed by its unsubscribe link. Requests that are still open are kept until they are answered, and signups until they are removed: the periods below start then.

Resolved requests are deleted after 730 days, spam after 30 days, attachments after 180 days; backups are kept 7 days.

Ask the site that sent you here to delete or export what you sent; they can find and remove everything sent with an email address at once.

Error reports

No personal data. Endpoints: POST /_care/error, GET /_care/errors/config.

What is reported:

• errors the site reports itself (logsure.error), and those its servers report
• errors the page did not catch, and promises rejected without a handler
• console.error calls
• requests the page made that failed or were refused (4xx and 5xx answers)
• scripts, style sheets and images that did not load

What a report keeps:

• the error's message and type, and where in the code it happened (the stack, at most 16 KB)
• the page address, without its query string or #fragment
• the app's release and environment
• the browser name, operating system, device type and country
• for a failed request: its method, its address without the query, its status and how long it took; never what it sent or got back, nor its headers
• from a browser, the same daily visitor code as analytics, to count how many people an error reached

Before anything is stored, email addresses, tokens and keys, card-like numbers and the query strings of addresses are removed from the message, the stack, the page address and the error's properties.

Error reports are deleted after 90 days.