Privacy Policy

Last updated: September 20, 2026

At Privatrak, we are committed to building a privacy-first product analytics service. This policy describes what data we collect, how we use it, and your rights regarding that data.

Privatrak is operated by Omexa LLC, a Wyoming limited liability company ("Privatrak", "we", "us", "our").

This policy covers two distinct groups:

1. Visitors to websites that use Privatrak (your end users)
2. Customers who have a Privatrak account (you)

Analytics on our own websites: We use Privatrak on our own landing page (privatrak.com) and dashboard (app.privatrak.com) to understand how our visitors and customers use our websites. The same privacy guarantees described in Section 1 apply — no cookies, no personal data, no fingerprinting. We practice what we preach.

1. Visitors to Websites Using Privatrak

What we do NOT collect

When a website owner installs the Privatrak tracking script on their site, we do not collect any personal information from visitors. Specifically:

• No cookies. During normal operation, the Privatrak script does not set, read, or use any cookies, localStorage, or sessionStorage. We use credentials: 'omit' on all network requests. (The Element Picker developer tool uses sessionStorage for ephemeral UI state — see Section 2.)
• No IP addresses stored. IP addresses are processed transiently in memory to derive anonymous session identifiers via HMAC, but are never stored, logged, or recoverable. The HMAC key rotates daily, making session IDs unlinkable across days.
• No User-Agent strings stored. User-Agent strings are processed transiently in memory alongside IP addresses for session derivation, but are never stored, logged, or recoverable.
• No fingerprinting. We do not use canvas fingerprinting, WebGL fingerprinting, font enumeration, or any other browser fingerprinting technique. Session derivation uses a privacy-preserving HMAC hash — not browser fingerprinting techniques.
• No cross-site tracking. We do not track visitors across different websites.
• No persistent identifiers. Session identifiers are derived server-side from a daily-rotating HMAC key. They are consistent within a single day of the website's configured timezone for the same browser but cannot persist across days (the key rotates at midnight in that timezone) or be reversed to recover the original inputs.

What we do collect

We collect anonymous, aggregate usage data:

• Page URLs — by default, sanitized to remove potentially identifying path segments (numeric IDs, UUIDs, and hex strings are replaced with :id) and query parameters (email, token, key, password, and secret values are replaced with :redacted). Website owners can customize these sanitization rules through project privacy settings.
• Referrer URLs — the page that linked to the current page, sanitized in the same way
• Event types — pageviews, clicks, form submissions, and custom events
• Element information — for click and form events: the HTML tag name, two CSS selectors — one specific and one generalized (each limited to 200 characters), and visible text content (limited to 100 characters)
• Timestamps — truncated by the server to whole seconds, always downward, before storage, to prevent event-level cross-referencing

Interaction tracking exclusions

The tracking script records click and form submission events with element metadata (tag name, CSS selector, visible text). The following element types are always excluded from interaction tracking:

• Password fields (type="password")
• Hidden fields (type="hidden")
• Credit card fields (inputs with autocomplete="cc-*")

Custom tracking attributes

Website owners may add data-track attributes to HTML elements to assign custom event names, and data-track-* attributes to attach arbitrary key-value metadata. The content of these attributes is determined entirely by the website owner.

Custom events and attributes

Website owners may send custom events with arbitrary names and key-value attributes using the Privatrak API. The content of custom events is determined entirely by the website owner, not by Privatrak. If a website owner chooses to include personal information in custom event attributes, that is their responsibility. See Section 6 below.

No consent banner required

Because Privatrak does not use cookies, does not collect personal data, and does not track visitors across sites, websites using Privatrak are not required to display cookie consent banners or privacy consent dialogs under the GDPR, ePrivacy Directive, or similar regulations. No raw personal data is stored — session identifiers are derived from an irreversible daily-rotating HMAC hash, so no consent is required.

Data retention

Product analytics data is retained based on the website owner's subscription plan:

After the retention period, data is automatically and permanently deleted through a scheduled cleanup process that runs hourly.

User flows are kept for a shorter period. The navigation paths shown on the Flows page are retained for 90 days regardless of plan. On the Pro plan that means events, statistics and funnels reach back 180 days while flows reach back 90. Where a plan's own retention period is shorter than 90 days, flows end when the events end.

2. Privatrak Account Holders (Customers)

Data we collect

When you create a Privatrak account, we collect:

• Email address — required for account creation, login, email verification, and service communications
• Name — used for display within the dashboard
• Password — stored as a bcrypt hash (cost factor 12); we never store or have access to your plaintext password

If you sign in with Google OAuth, we additionally receive and store:

• Google provider user ID — used solely to link your Google account to your Privatrak account
• Your name and email from your Google profile

We do not request or receive any other data from Google (no contacts, calendar, drive access, etc.).

Cookies

The Privatrak dashboard uses two cookies, both strictly functional:

• session_token — an HTTP-only session cookie used to keep you logged in. It cannot be accessed by JavaScript, and it expires after 30 days or when you log out.
• __cf_bm — set by Paddle, our payment provider, on their own domain when the payment library loads on billing pages. It is Cloudflare's bot-protection cookie, it lasts about 30 minutes, and it exists to tell automated abuse from real people on payment requests. It carries no advertising or cross-site profiling function.

No consent banner is required for strictly functional cookies under the ePrivacy Directive.

We use no tracking cookies and no advertising cookies anywhere, and we do not profile you across websites.

Element Picker

When you use the Element Picker from the dashboard, the tracker script uses sessionStorage on your website to persist picker UI state (active status, scan mode, navigation mode) across page navigations within the same tab. This data:

• Contains no personal information — only boolean UI flags and the dashboard origin URL
• Is never sent to our servers or used for analytics

This sessionStorage usage only occurs when you, as an account holder, explicitly activate the Element Picker from the dashboard. It is never triggered during normal visitor tracking.

Communications

We send the following emails:

• Email verification — a one-time email when you register to verify your email address
• Weekly summary reports — optional product analytics summary emails sent every Monday. You can opt out at any time in your account settings.
• Event limit notifications — alerts when your monthly event usage reaches 80% and 100% of your plan limit
• Project invitations — emails sent when a team member invites you to collaborate on a project

All emails are transactional or opt-in. We do not send unsolicited marketing emails. You can manage your email preferences at any time in your account settings.

Billing

Payment processing is handled by our billing partner, Paddle (Paddle.com Market Limited). When you subscribe to a paid plan:

• Paddle collects and processes your payment information (credit card, billing address). We never see, store, or have access to your full payment details.
• We store only: your Paddle customer ID, Paddle subscription ID, plan type, subscription status, and billing period dates.
• Your IP address may be sent to Paddle temporarily for the sole purpose of displaying localized pricing. It is not stored by Privatrak.

Paddle's privacy policy governs how they handle your payment data: https://www.paddle.com/legal/privacy

Account deletion

You may delete your account at any time from your account settings. When you delete your account:

• Your user record and all associated data are permanently deleted
• All projects where you are the sole owner are permanently deleted, including all analytics data
• Your project memberships, sessions, API keys, and email preferences are removed
• This action is immediate and irreversible

If you are the sole owner of a project that has other members, you must first remove other members through the dashboard or contact support to transfer ownership before deleting your account.

3. Data Hosting and Security

Where your data is stored

All analytics data and account data is hosted on servers in the European Union. Data does not leave the EU for storage or processing, with the exception of email delivery (see Sub-processors below).

Security measures

• All data transmitted between your browser and our servers is encrypted using HTTPS/TLS
• Passwords are hashed using bcrypt with a cost factor of 12
• Session tokens are hashed using SHA-256 before storage
• API keys are hashed before storage; only a prefix is stored in plaintext for identification
• All database queries use parameterized statements to prevent SQL injection
• Database access is restricted to our application servers via private networking
• Server logs, reverse proxy logs, and monitoring systems record only request method, URL path, HTTP status code, and response time. IP addresses, User-Agent strings, and request headers are never written to any log or monitoring system.

4. Sub-processors

We use the following third-party service providers to operate Privatrak:

Note on Resend (email): Resend is based in the United States. Email addresses are transmitted to Resend solely for the purpose of delivering transactional emails (verification, weekly summaries, notifications, invitations). Analytics data is never shared with Resend. Appropriate data transfer safeguards are in place.

We do not sell, share, trade, or monetize your data or your visitors' data with any third party for any reason.

5. Your Rights

Depending on your location, you may have the following rights:

For all users

• Access — you can view all data associated with your account in the dashboard
• Deletion — you can delete your account and all associated data at any time
• Email preferences — you can opt out of non-essential emails at any time

For EU/EEA residents (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing
• Data portability
• Object to processing
• Lodge a complaint with your local data protection authority

Our lawful basis for processing customer account data is contract performance (we need your email and name to provide the service) and legitimate interest (for service communications and security). For optional features like weekly summary emails, the basis is legitimate interest (opt-out available in account settings).

For California residents (CCPA/CPRA)

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. You have the right to know what data we collect, request deletion, and opt out of any sale of personal information (though no sale occurs). To exercise these rights, contact us at the address below.

6. Customer Responsibility for Data Content

Privatrak provides a privacy-first product analytics tool that collects no personal information by default. However, our customers may choose to send additional data through custom events, custom event attributes, session traits, or data-track / data-track-* HTML attributes.

If you are a website owner using Privatrak:

• You are solely responsible for the data you choose to send to Privatrak through custom events and attributes
• You must ensure you have a lawful basis for collecting and transmitting any data you send
• You are responsible for your own privacy policy towards your end users
• You must not send data you are prohibited from sharing under applicable law

The following data types must never be sent to Privatrak:

• Protected health information (HIPAA)
• Data of children under 13 (COPPA)
• Financial account numbers or credit card data
• Government-issued identification numbers (SSN, passport numbers, etc.)
• Data subject to sector-specific regulations you have not accounted for

Privatrak processes custom event data as instructed by the customer. We do not inspect, validate, or filter the content of custom event attributes or data-track-* values beyond the automatic exclusions described in Section 1 (password fields, credit card fields, hidden fields).

7. Changes to This Policy

We may update this privacy policy from time to time. We will notify account holders of material changes via email. The "Last updated" date at the top of this page will always reflect the most recent revision.

8. Contact

If you have questions about this privacy policy or your data, contact us at:

Email: privacy@privatrak.com

Omexa LLC Wyoming, United States