Clickport
Start free trial
For agencies For SaaS For e-commerce For affiliates For publishers & bloggers For enterprise Google Search Console Bing Webmaster Tools WordPress Shopify Tracker install SPA tracking Custom Events API reference vs Google Analytics vs Matomo vs Cloudflare
Migrate from Google Analytics Blog Updates Documentation UTM Builder GDPR Checker GA4 Data Loss Estimator Is Google Analytics legal? About Contact Status Security How it works

Privacy Policy

The analytics tracker sets no cookies. This policy explains visitor analytics, operational logs, and the account information needed to provide the service.

At Clickport, we are committed to complying with GDPR, CCPA, PECR, and other privacy regulations on our website and on our analytics product. We promise to never sell your data. Never have, never will.

Here is what that means in practice.

As a visitor to a website using Clickport

When a website owner installs Clickport, the tracker collects pageviews, events, and session data for analytics reports. Analytics records use rotating visitor identifiers. Operational logs separately retain request information for security and recovery.

Specifically, we do not:

  • Set any cookies or use localStorage for tracking
  • Store raw IP addresses in visitor analytics records
  • Require visitor names or email addresses for analytics
  • Use fingerprinting techniques
  • Track visitors across websites or devices
  • Share data with advertising companies
  • Mine or monetize visitor data in any way

What we do collect

We collect traffic and engagement data to help website owners understand their websites. This includes:

  • Page URLs and referrer sources
  • UTM campaign parameters
  • Country, region, and city, derived from the IP address during request processing
  • Device type, browser, and operating system (from the User-Agent header, not fingerprinting)
  • Scroll depth and time on page
  • Click and form submission events (only the fact that they occurred, not what was typed)
  • Copy events, including the first 200 characters of the copied text, to help site owners understand which content visitors find useful

How sessions work

Sessions are determined on our servers. We calculate a visitor identifier from the IP address, browser, calendar date, and a server-side secret. The date makes the identifier change daily. Raw IP addresses are excluded from visitor analytics records.

The server-side secret does not rotate daily. Operational logs remain separate from the visitor identifiers used in analytics records.

The tracker writes a small numeric session marker to the browser's sessionStorage. This auto-clears when the tab closes and is not used by our server to identify or group visitors. The marker will be removed entirely in an upcoming tracker release.

Operational logs

Server logs and event recovery logs retain IP addresses. Event recovery logs also contain request bodies, user agents, and referrers. We use these records for security, troubleshooting, and recovery after an outage.

Server logs rotate daily, with 30 rotated files retained. Backup copies follow separate backup retention schedules. Access is restricted to server operators. See our security practices for details.

As a Clickport customer

When you create a Clickport account, our guiding principle is to collect only what we need and to solely process this information to provide you with the service you signed up for.

Email address

We require your email address to create an account. We use it to log you in, send password reset emails, and communicate important service updates. We will never send unsolicited marketing emails.

Password

Your password is securely hashed before storage. We never store or have access to your plain-text password.

Login session

A session cookie is stored when you log in to remember your authenticated state. This is a functional, first-party cookie required to operate the dashboard. It is not used for tracking.

Account sessions record an IP address and device information. Sessions expire after 60 days. The account activity log also records IP addresses for security events and retains entries for 12 months.

Product usage data

While you are logged in, we record how the dashboard itself is used: which screens and panels you open, which controls you interact with, and which date ranges and filters you apply. These records are linked to your account.

We collect this for three reasons: to support you (including proactively, when the data shows a configuration that cannot work as intended), to debug problems, and to decide which parts of the product to improve. It is processed by us alone, on our own infrastructure, with no third-party analytics tools involved, and it is never sold or shared.

Product usage records are automatically deleted after 90 days. Separately, actions that change a site's configuration, such as editing goals or inviting a team member, appear in that site's own team activity log, which is visible to you and your team and retained as part of your account.

Blog comments

If you submit a comment on our blog, your name and email address are saved in your browser's localStorage to pre-fill the comment form on future visits. This data stays entirely in your browser and is not used for tracking. You can clear it at any time through your browser settings.

Data hosting

Our analytics databases, account database, operational logs, and backups are hosted by Hetzner in Germany. Resend and Paddle separately process customer email and billing information. The DPA describes these providers and international processing arrangements.

Third-party services

We use a minimal number of third-party services, all carefully selected for their privacy practices:

  • Hetzner (Germany): Server hosting, database storage, and infrastructure
  • Resend (USA): Transactional email delivery (password resets and account notifications only)
  • Paddle: Payment processing and billing as our merchant of record. When you subscribe to a paid plan, Paddle processes your payment information. See Paddle's privacy policy

We do not send visitor analytics data to Resend or Paddle. If you choose Google or GitHub sign-in, that provider processes your sign-in request. Optional integrations connect to the services you select.

Data retention

Your analytics data is retained for as long as your account is active. There are no artificial data expiry windows. We believe your historical data belongs to you and should be available for as long as you need it.

You can delete your account at any time from the account settings page. When you do, all your data is permanently and immediately deleted from our servers. This includes your account information, all tracked sites, and all associated analytics data. This action is irreversible.

Changes and questions

We may update this policy as we add new features or as regulations evolve. We will announce significant changes via our blog or through the dashboard.

If you have questions about this privacy policy or how we handle data, contact us or email privacy@clickport.io.

Last updated: September 22, 2026.