Privacy Policy

Last updated: August 24, 2026

This page is a good-faith, accurate description of how Dodolytics actually handles data, based directly on how the software is built. It is not a substitute for professional legal review — if you operate Dodolytics for a business or in a jurisdiction with specific regulatory requirements, have a lawyer review this before relying on it.

Who runs this

Dodolytics is self-hosted software. The entity operating this particular installation, not the Dodolytics software itself, is the data controller for any data collected here.

Account data

If you register for an account, we store your email address, display name, and a bcrypt hash of your password — never your password itself. Your plan (free or pro) and admin status are also stored against your account.

Website visitor data

When a tracked website's visitor loads a page, the tracking script sends the page URL, referrer, and basic browser/device information to the server, which derives a browser, operating system, device type, and country (from the hosting network's edge location, not a third-party geolocation lookup) before storing anything. Custom events, if the website owner has added them, are recorded the same way.

Visitors are identified by a privacy-preserving hash that rotates every calendar day — it is derived from the visitor's IP address and a server-side secret at the moment of the request, and the IP address itself is never stored. Because the hash changes daily, it cannot on its own be used to track the same visitor across multiple days, and it cannot be reversed back into an IP address. The one deliberate exception to this is described next.

Visitor identification (optional, and only if the website owner chooses to use it)

Dodolytics offers an optional analytics.identify(email) function a tracked website's own code can call — for example, right after a visitor logs into that website. This is never called automatically by the tracking script itself, and it never inspects page content, form fields, or anything else to find an email address on its own; it only runs when the website owner's own code deliberately calls it with a specific address.

When this is used, that visitor's browsing on that website becomes linked to their email address, and that link persists across days — it is a deliberate, disclosed exception to the daily-rotating, cannot-be-tracked-across-days design described above, which still applies to every visitor who is never identified this way. The email address is encrypted before being stored, and is only ever decrypted to display it back to the website owner in their own reports. An identity created this way is always specific to one tracked website — identifying the same email address on two different websites run through this installation creates two separate, unlinked records, consistent with the "no cross-site tracking" promise below.

A website owner can permanently erase one identified visitor's email address at any time from that website's settings page, which also removes the link to their browsing history — their past sessions and pageviews remain in the analytics data, pseudonymous, exactly like every other visitor's. If a website owner has configured an automatic data retention period (see "Data retention" below), an identified visitor who hasn't identified again within that same window is erased automatically the same way.

This feature is entirely optional for the operator of this installation to even make available — on an installation where it hasn't been configured, analytics.identify() has no effect at all and nothing is stored.

What we do not collect

• No cookies are set by the tracking script.
• No raw IP address is ever written to the database.
• No cross-site tracking — each website's data is kept separate, and visitors are not tracked across unrelated sites.
• No sale or sharing of data with advertisers or data brokers.

Data retention

By default, analytics data is kept indefinitely. A website operator may configure an automatic retention period, after which older visitor data (and everything derived from it) is permanently deleted. Account data is kept until the account is deleted or the operator removes it directly.

Where data is stored

Data is stored in a database on the server this installation runs on — there is no third-party cloud analytics provider involved, and no data leaves this server as part of normal operation.

Your rights

If you have an account, you can review and update your profile information from your account settings at any time. To request access to, correction of, or deletion of your data, contact the operator of this installation directly.

Changes to this policy

If this policy changes, the "Last updated" date above will change to reflect it.