Privacy
Last updated 25 September 2026
This page has two audiences. If you landed here from a website that uses OriginStat, section 1 is about you. If you are an OriginStat customer, sections 2 onwards are about your account.
The short version. We set no cookies on the sites we measure, and never store an IP address or a user agent. The identifier that tells one visitor from another is a hash that is rebuilt from a secret every midnight UTC, so it cannot follow anybody into tomorrow, and it is different on every site. We do not sell data, we do not run ads, and we do not build profiles across our customers' sites.
1. If you visited a site that uses OriginStat
The site you visited embeds a script that sends us one small message per page view. That site's owner is the data controller and decides to use us; we act on their instructions.
What is sent
- The page URL and the referring URL, including any campaign parameters in the link (such as
utm_source). - The width of your browser window, and how long the page was open.
- How long the page took to load: three durations in milliseconds, read from your browser's own timing (when the first byte arrived, when the largest element was drawn, when loading finished). They describe the page, not you, and the site's owner can switch them off.
- The page you were on immediately before this one, and the last three pages of this visit, as paths on the site you are visiting, never anything from another website. This is what lets the site's owner see the order their pages get read in. It resets when the visit does.
- The name of an action, if the page's owner has marked a button as a goal.
- Your country and region, and your browser, operating system and device type, all derived by our host from the connection and the user agent string.
What is never stored
Your IP address and your user agent string are used once, in memory, and never written down. They are combined with a site identifier, the current date and a secret we hold, then hashed. Only the first eight bytes of that hash are kept. That value is what distinguishes one visitor from another for the rest of the day, and because the date is part of the input, it is discarded and rebuilt at midnight UTC. It cannot be reversed into an address, it is not shared between two sites, and it does not survive the day.
Storage on your device
The script keeps a small record in the website's own localStorage, not a cookie and never readable by any other site. It holds a counter and timestamp used to tell one visit from the next, the paths of up to the last three pages of the current visit, and, where the site owner has enabled revenue attribution, a note of the source and campaign of your first visit so that a later purchase can be credited to it. It contains no name, no address and no account identifier. You can clear it at any time through your browser's site-data controls, and the script continues to work without it.
Depending on where you are, storing anything on your device may require the website's consent notice to mention it. That is a decision for the owner of the site you visited, not for us. They can switch this storage off, and if they have, none of the above is written at all.
How long it is kept
Individual events are held for 90 days. After that only aggregates remain: counts by day, page, source, country and device, which contain nothing specific to any one visitor.
2. If you have an OriginStat account
We hold what running the account requires and nothing beyond it:
- Your email address, and a password stored only as a PBKDF2-SHA256 hash at 600,000 iterations.
- Your sites, their settings, and the analytics they collect.
- Your plan, billing status and billing period.
- If you turn on two-factor authentication, a shared secret and your recovery codes.
- If you connect a payment provider to attribute revenue, the read-only key you gave us, encrypted with AES-GCM under a key held separately from everything else, and shown back to you only as a masked fragment.
For abuse limits we store a salted hash of the address a signup came from. As with visitor identifiers, the address itself is never written down.
The one cookie on this site
Signing in sets a single cookie, os_session. It holds a random session identifier and nothing else (no email, no name, nothing readable), and it is marked HttpOnly, Secure and SameSite=Lax, which means script cannot read it, it never travels unencrypted, and it is not sent when another site links to us. It exists so that you stay signed in, it lasts as long as your session does, and signing out deletes it. Because it does nothing but keep you signed in, it is the kind of strictly necessary cookie that needs no consent banner anywhere.
That is the whole list. It is worth being exact about, because the product this account is for sets none at all: the page you are reading and the analytics we sell are two different pieces of software, and only one of them has anybody signed in to it.
3. Why we are allowed to hold it
If your law asks for a legal basis (the UK and EU GDPR do, and several other regimes borrow the idea), this is ours, per thing held rather than as one blanket claim:
| What | Basis |
|---|---|
| Your email, password hash, sites and settings | Performance of the contract: it is the account you asked us to run. |
| Your plan, billing status and payment records | Contract, and legal obligation for anything tax and accounting law makes us keep. |
| Two-factor secrets and recovery codes | Contract, because you switched it on, and our legitimate interest in your account not being taken. |
| The salted hash behind signup and rate limits | Legitimate interest in not being used to farm free accounts or to bury somebody's inbox. It is a hash precisely so the interest can be served without keeping the address. |
| Service email: verification, alerts you enabled, security notices | Contract. We do not send marketing on this basis, and there is none to opt out of. |
| Analytics about the sites you measure | Not ours to claim. There you are the controller and we are your processor: the basis is whichever one you rely on, and the data processing agreement is the contract that binds us to it. |
4. Who else touches it
| Processor | What for | Where |
|---|---|---|
| Cloudflare | Hosting, the database, and analytics storage | Global edge network |
| Resend | Transactional email: sign-in codes, alerts, summaries | United States |
| Polar | Payments, as merchant of record | United States |
That is the whole list. We add no analytics of our own to your dashboard beyond OriginStat measuring its own marketing pages, we run no advertising trackers, and we share nothing with anyone not named above except where the law requires it.
5. Your rights
If you are in the UK, EU, or another jurisdiction with comparable law, you may ask for a copy of what we hold about you, ask us to correct or delete it, object to how we use it, or ask for it in portable form. Write to support@originstat.com and we will answer within 30 days.
For analytics data about a site you do not own, we are the processor and not the controller: we will pass your request to the site's owner, who is the one able to act on it.
Deleting your account removes your sites, their analytics and your connected credentials. Backups age out within 30 days.
6. Contact
The controller for account data is Oktobar.
Questions, requests and complaints go to support@originstat.com, which is the only address you need for any of them and the one that will be answered fastest. If you are in the EU or UK you also have the right to complain to your local supervisory authority.
If this page changes in a way that affects you, we will say so by email before it takes effect.