Privacy Policy
frapi.io is built around a simple idea: you can understand your traffic without collecting personal data about your visitors. This policy explains what we collect, what we deliberately do not collect, and how both work.
What we collect
- Account data: the email address you sign up with and a securely hashed (argon2) password.
- Analytics data you choose to track: page path, page title, referrer, browser class, operating system, screen width and language — the inputs that power your dashboard.
- Billing data: none during beta; if paid plans launch, a payment provider will process charges and we will not store card numbers.
What we never collect
The tracking snippet transmits no personal data, and our servers discard the following before anything is stored:
- IP addresses (used only transiently for visitor dedup, then discarded),
- Full user-agent strings (reduced to a browser and OS class),
- Cookies, device IDs, or any other persistent identifier,
- Fingerprints or any cross-site/cross-device identifiers.
Cookies
The tracking snippet sets no cookies. Your browser's dashboard session uses a first-party session cookie plus a short CSRF cookie — both are functional, expire automatically, and hold no personal information.
Visitor counting
To estimate unique visitors we compute a salted hash of short-lived inputs (such as IP and user agent), and that salt rotates daily. The raw inputs are discarded immediately, so the stored hash cannot be reversed, and one visitor's hash is not linkable across days.
Data retention & deletion
Raw hits and aggregated rollups are retained for the life of your account. You can export your data at any time via the JSON API or CSV. Deleting a site — or your account — removes its data.
Your rights
Where data protection law applies, you can request a copy, correction, or deletion of your account data by emailing support@frapi.io. Because we store no personal data about your visitors, there is nothing to access or erase on their behalf.
Legal basis
We rely on our legitimate interest in operating and improving the Service for account data, and on the lawful collection of aggregate, non-personal analytics for the analytics data you track. No consent banner is required, because no consent-requiring technical data is involved.
Third parties & subprocessors
We use hosting and infrastructure providers to run the Service; they process data only on our instructions. We do not sell, rent, or share your analytics data with anyone. No advertising network or data broker is involved at any point.
Security
Passwords are hashed with argon2. API tokens are stored only as SHA-256 hashes and can be revoked. Traffic is served over TLS. Only the minimum infrastructure needed to operate the Service has access to your data.
Changes
We will announce material changes to this policy on the Service or by email. Continued use after changes take effect means you accept the updated policy.
Contact
Privacy questions or data requests: support@frapi.io.