Privacy Policy

Who is responsible

In this policy, "Clicktag", "we" and "us" mean the team behind Clicktag. You can reach us at privacy@clicktag.io.

• Visitors to our customers' websites: the website owner decides to use Clicktag and controls that data. We process it on their behalf, under the data processing terms in our Terms of Service.
• Clicktag account holders and visitors to clicktag.io and clicktag.app: Clicktag is the controller.

What the Clicktag script collects

When someone opens a page on a site that uses Clicktag, the script (served from clicktag.io, or totallytics.com on older installs) sends us:

• the page address and the page that linked to it;
• campaign tags from the address, such as utm_source and utm_campaign (other query parameters are dropped unless the site owner allows them);
• browser, operating system, device type and the browser's user agent text;
• screen and window size, browser language and time zone;
• how long the page stayed open and how far it was scrolled;
• events the site owner tracks, such as button clicks or sign-ups, with any details the site owner attaches;
• random IDs, created fresh on every page load, that tie events and time on page to the right page view;
• error reports when the Clicktag script itself fails.

The script sets no cookies and writes nothing to local storage. Visits from browsers with Do Not Track switched on are never recorded.

Counting visitors without cookies

To tell unique visitors apart, our server combines the visitor's IP address and user agent with the website's address, the date and a random value (a salt), and turns them into a one-way hash. A new salt is made every day and the old one is deleted shortly after midnight UTC, so the hash can't be linked across days or turned back into an IP address. The IP address is only used in memory, for this hash and the Live view, and is never stored in Clicktag's databases.

Country and city

We work out a visitor's country from their browser's time zone, not their IP address. The Live view shows the approximate city of people on a site right now, using Cloudflare's location lookup at the moment of the visit; we don't store it.

Returning visitors

To measure retention, the script asks our server about once a day whether this browser has visited the site before. Your browser keeps our reply in its normal HTTP cache, and the reply's date only holds the days of your first and latest visit to that one site. The next day, your browser sends that date back and we count a returning visit. Site owners can turn this off with data-retention="false".

Server logs

Cloudflare, which runs our servers, keeps a log of each request for up to 7 days, including the IP address, approximate location and the full address requested. We use it only to fix errors and stop abuse, and it's deleted automatically.

Other data site owners can send

• API monitoring: the method, endpoint, status code and response time of requests to the site owner's API, the client name and version from the user agent, an ID the site owner picks for their API customer, and error messages of failed requests. We don't receive IP addresses, request bodies, query strings or any other headers.
• AI crawler tracking: if the site owner connects Cloudflare, hourly counts of AI crawler visits per page. We use the crawler's IP address only to check that it's genuine, and don't store it.

What we collect from account holders

• Your Google sign-in: your email address, name and profile photo, through Firebase Authentication (run by Google), which also handles sign-in security. We keep your email address and account ID in our own database. We never see your Google password.
• A sign-up notice: when you create an account, we email ourselves your name, email address, approximate location (city and country) and device type, once.
• What you set up: your sites, goals, funnels, reports and the email addresses you send them to, the people you share a site with, and API keys (we store only a hash of each key).
• Connections you add: for Google Search Console, an encrypted token and your search data, such as queries, pages, clicks, impressions and positions; for Cloudflare, an encrypted read-only API token. If you import history from another analytics service, we keep its API key only until the import finishes, or for 7 days if it fails or you cancel it.
• Email with us: if you contact us, we keep the conversation.
• Our own analytics: clicktag.io and clicktag.app use Clicktag itself, with the same data as above, plus events such as sign-up clicks.

People who get Clicktag emails without an account, such as report recipients, only have their email address and email settings stored. Report emails include an unsubscribe link.

Cookies and browser storage

• The Clicktag script sets no cookies and uses no local storage.
• In the dashboard at clicktag.app, Firebase keeps you signed in using your browser's storage, and we save interface preferences, such as your theme, chart settings and recently opened sites, in local storage.
• When you connect Search Console, we set one cookie (__Host-gsc_oauth_nonce) for up to 10 minutes to protect the connection step. Google sets its own cookies on its sign-in pages.

Why we use it

• Account data, connections and emails: to provide the service you signed up for.
• Sign-up notices, server logs and our own analytics: our legitimate interest in running Clicktag securely and improving it.
• Visitor data on customers' sites: the site owner decides and needs their own legal basis; we only act on their instructions.

Who processes data for us

Clicktag's analytics and account databases are in Frankfurt, Germany. Requests pass through Cloudflare's global network, so they're first handled at the data center nearest to the visitor. Cloudflare, Google and Postmark may process data outside the EU, including in the United States; for those transfers we rely on the EU-US Data Privacy Framework or the EU's Standard Contractual Clauses.

How long we keep it

To erase a site's data, or your whole account, email us and we do it within 30 days.

Security

• Everything is sent over HTTPS.
• Search Console and Cloudflare tokens are encrypted before we store them, and API keys are stored only as hashes.
• IP addresses never reach Clicktag's databases.
• Only the people who run Clicktag can access production systems.

If a breach affects your personal data, we'll tell you, and the authorities where the law requires it, without undue delay.

Your rights

You can ask us for a copy of your personal data, or ask us to correct it, delete it, limit how we use it, or send it to you in a portable format. You can also object to processing based on our legitimate interest. Email privacy@clicktag.io and we'll reply within a month.

If you visited a website that uses Clicktag, contact that website first, since they control that data; we'll help them answer. Because Clicktag doesn't store IP addresses or set cookies, we usually can't tell which records belong to you.

You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the data protection authority where you live.

Google user data

Clicktag's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Search Console access only to show your search data in Clicktag. We don't sell it or use it for ads, and we only look at it when you ask us for help, for security, or when the law requires it.

Children

Clicktag accounts are for people aged 16 and over.

Changes to this policy

If we change this policy in a way that matters, we'll email account holders before the change takes effect. The date at the top shows the current version.

Contact

Privacy questions or requests: privacy@clicktag.io.