Privacy Policy

1. Introduction

didthey.click is a privacy-friendly web analytics service. This policy explains what data we collect, from whom, and why — split into two groups: (1) the visitors of websites our customers track with our script, and (2) the people who hold a didthey.click account.

For website visitors, our customer is the data controller and we act as their data processor — we collect and process visitor data only to provide analytics back to the site owner, under the terms of our Data Processing Agreement. For account holders, didthey.click is the data controller.

2. Data about website visitors

When a website embeds our tracking script, we collect anonymized, aggregate-style event data about its visitors:

• Page URL, referrer, and UTM/ad-click parameters
• Browser, operating system, and device type — parsed server-side from the User-Agent header
• Approximate country, region, and city, derived from IP address via GeoIP lookup
• Viewport size and scroll depth
• Custom events the site owner chooses to track (e.g. button clicks, form submissions)

We do not use fingerprinting or any technique designed to re-identify a specific person, and we don't track visitors across unrelated websites. To group a visitor's events into a single visit and session, the tracking script stores a randomly generated identifier in a first-party cookie on your customer's domain (not shared with any other site) — one that lasts up to a year for the visitor identifier, and up to 30 minutes of inactivity for the session identifier. These identifiers are just random values; they don't encode or derive from anything about your device or browser.

Visitor IP addresses are used transiently, in memory, to resolve GeoIP location and to verify known crawler/bot traffic — they are not written to our database or retained after that lookup.

If a visitor is detected as a search-engine or AI crawler, we may separately record that a crawler of a given type visited a given page, to power crawler-analytics features. This is about classifying bot traffic, not about identifying people.

3. Data about account holders

If you create a didthey.click account, we collect:

• Account details: your email address and name
• Authentication data: a securely hashed password, or — if you sign in with Google — your Google account's name, email, and profile picture
• Session data: sign-in sessions record the IP address and user-agent of the device you signed in from, for security purposes (session management is handled by our authentication provider)
• Billing data: if you subscribe to a paid plan, Stripe processes your payment details — we never see or store your full card number
• Support communications: anything you send us when you contact support

4. Optional integrations you connect

You can choose to connect additional accounts to enrich your dashboard. If you do, we access only the data needed to power that feature:

• Stripe: your own Stripe account's payment data, to attribute revenue to visits
• Google Search Console: search performance data for properties you authorize
• Bing Webmaster Tools: search performance data for properties you authorize

These integrations are opt-in — nothing is connected unless you set it up yourself.

5. Why we process this data

• To provide the analytics dashboard and features you or your customers use
• To operate your account, billing, and support
• To keep the Service secure and to detect abuse or bot traffic
• To comply with legal obligations

We do not use visitor or account data for advertising, and we do not sell personal data to third parties.

6. Where your data is hosted

didthey.click's application is hosted on Vercel and our database on Neon (AWS), both in the United States. Where data of EU residents is processed there, we rely on our providers' GDPR data processing agreements, which incorporate the EU's Standard Contractual Clauses. Payments are processed by Stripe. If you connect Google or Microsoft (Bing) integrations, those providers process the data needed for that integration under their own privacy policies.

7. Data retention

Analytics event data is kept for as long as your plan's retention window: 30 days on the Free plan, 3 years on Pro, and 5 years on Business. Once that window passes, events are purged automatically. If you downgrade or your subscription lapses, retention follows your new plan going forward.

Account data (email, name, billing history) is kept for as long as your account exists. When you delete your account, we delete your account data; some records may be kept briefly where we're legally required to (e.g. billing records for tax purposes).

8. Your rights

If you're an account holder, you can access, correct, export, or delete your account data at any time from your account settings, or by contacting us at hello@didthey.click.

If you're a visitor of one of our customers' websites and have questions about the data collected about you, please contact that website directly — they're the data controller for that data. You're also welcome to contact us at hello@didthey.click and we'll do our best to help or point you to the right place.

Depending on where you live, these rights may include access, correction, deletion, data portability, objection, and restriction of processing. We'll respond to verified requests within 30 days.

9. Security

We use HTTPS/TLS for data in transit, hash passwords rather than storing them in plain text, and restrict access to production data to what's needed to operate the Service. No system is perfectly secure, but we take reasonable steps to protect your information.

10. Children's privacy

didthey.click is a B2B analytics tool intended for business and professional use. It is not directed at children, and we do not knowingly collect personal information from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make a material change, we'll update the "Last updated" date above and, where appropriate, notify account holders by email.

12. Contact us

Questions about this policy or how we handle your data? Email us at hello@didthey.click.