Legal
Privacy policy
ThunderStats is built so that there is very little to disclose here. No cookies, no IP addresses in storage, no profile of anybody.
Last updated: 18 August 2026
This policy covers two different groups of people, and it is worth being clear which one you are:
- Visitors to a website that uses ThunderStats. You never interact with us directly. Section 1–5 applies to you.
- Customers who have a ThunderStats account. Sections 6–9 also apply to you.
1. What we collect about website visitors
When you visit a site that uses ThunderStats, the following is recorded about the page view. It is collected on behalf of that site’s owner, who decides what to do with it.
| Data | Where it comes from |
|---|---|
| Page URL and path | The address of the page you opened, with the query string removed before storage. |
| Referrer | The site you arrived from, reduced to its domain and path. |
| Campaign tags | utm_source and related parameters, if the link you followed had them. |
| Approximate location | Country and city, looked up from your IP address at the moment of the request. The IP itself is not kept — see section 2. |
| Browser, operating system, device type | Derived from the User-Agent your browser sends. |
| Screen width | Reported by the browser, used to distinguish layout sizes. |
| Timestamp | When the page view happened. |
| Custom events | If the site owner has set them up: a name such as signup, optional properties, and an optional revenue amount. The site owner chooses what these contain. |
2. What we deliberately do not do
- No cookies, and nothing written to your device. ThunderStats does not set cookies, does not use local storage, and does not use any similar technique to persist an identifier in your browser.
- No IP addresses in storage. Your IP is used during the request to look up an approximate location and to compute the session hash described below, then discarded. It is never written to a database or a log we retain.
- No fingerprinting. We do not read canvas, fonts, audio hardware, installed plugins, battery status, or any other signal used to construct a device fingerprint.
- No cross-site tracking. The identifier is derived per site, so the same person visiting two ThunderStats sites cannot be recognised as the same person across them.
- No selling or sharing of data. We do not sell personal data, share it with advertisers, or use it to build audience segments. There is no advertising business here to feed.
3. How a visit is recognised without an identifier
To tell one visit from another without storing anything, ThunderStats computes a one-way hash (HMAC-SHA256) of four things: your IP address, your user agent, the site’s ID, and the current UTC date. Only the first 16 characters of the result are stored.
Three consequences follow, and they are the point of the design:
- The hash rotates every day. Yesterday’s visit and today’s visit from the same person are unconnected.
- It cannot be reversed to recover your IP address, because it is a keyed hash with a secret we hold.
- It differs per site, because the site ID is one of the inputs.
A site owner can alternatively supply their own session identifier when sending events from their server. In that case the identifier is theirs, and their own privacy policy governs it.
4. Legal basis and consent banners
Because no information is stored on or read from your device, ThunderStats does not require consent under the EU ePrivacy Directive (the “cookie law”). Site owners generally do not need a cookie banner for ThunderStats itself, though they may need one for other tools on the same page.
Where the data described in section 1 constitutes personal data under the GDPR, the site owner is the data controller and ThunderStats is a data processor acting on their instructions. The usual legal basis is the controller’s legitimate interest in understanding how their site is used.
5. How long data is kept
- Detailed event records are retained for up to 2 years, after which they are deleted automatically.
- On the free plan, detailed records are pruned after 365 days.
- Aggregated daily totals, which contain no individual records, may be kept for longer.
A site owner can delete a site at any time, which removes its data.
6. Where data is processed
Tracking requests are handled at edge locations around the world, close to the visitor who generated them. Analytics data is stored in databases that we operate and administer ourselves.
We keep the number of outside parties deliberately small. The infrastructure providers hosting our compute and storage process data only on our instructions and under contract, and a separate provider delivers account email — address verification, password resets and traffic alerts. That provider never receives analytics data.
We do not share data with advertising networks, data brokers, or analytics aggregators. There is no such arrangement to disclose.
7. Account data for customers
If you have a ThunderStats account, we store your email address, a hashed password, the sites you have added, and your settings. We also record account activity such as logins and API key creation, so that you can audit your own account.
We use your email only to operate the service: verification, password resets, and any traffic alerts you have switched on. Alerts are off by default.
8. Your rights
Under the GDPR, UK GDPR, and similar laws you may request access to your personal data, correction, deletion, restriction of processing, portability, or object to processing.
If you are a visitor to a site using ThunderStats, please contact that site’s owner — they are the controller of the data, and we usually have no way to connect a request to specific records, precisely because we do not store identifiers. Where a site owner asks us to act, we will.
If you are a customer, contact us directly and we will action the request.
You also have the right to lodge a complaint with your local data protection authority.
9. Changes to this policy
If this policy changes in a way that materially affects what is collected or how it is used, we will update the date at the top and notify account holders by email.
10. Contact
ThunderStats is operated as an independent service. For anything covered by this policy — a question, a data request, or a complaint — email hello@thunderstats.com and a person will answer.