How Clickport protects your data. EU-hosted, encrypted, minimal by design.
Clickport collects only aggregate, non-personal metrics. We do not track individual visitors across sessions or devices. The less data you store, the less there is to protect.
IP addresses are used at request time for country-level geolocation and then immediately discarded. They are never written to databases, logs, or any persistent storage.
Visitor identifiers are generated using HMAC-SHA256 with a daily-rotating random salt. The salt changes every 24 hours, making it impossible to link visitors across days or reverse the hash to recover the original IP address.
All data is encrypted in transit via HTTPS (TLS 1.2+). Connections without HTTPS are automatically upgraded.
Passwords are hashed with bcrypt before storage. We never store or have access to plain-text passwords.
All data is stored on servers operated by Hetzner Online GmbH, a German company with data centers in Germany. Your analytics data and account information never leave the EU.
Hetzner maintains ISO 27001 certification covering physical security, access controls, and environmental protections at their data centers.
Server access is restricted to the founder only via SSH key authentication. Password-based SSH login is disabled.
No third-party analytics, tracking, or monitoring services run on the Clickport dashboard. We do not use external error tracking tools that could expose customer data.
Your data belongs to you. We do not sell, share, or monetize it in any way.
You can export all your analytics data as CSV at any time. You can delete individual sites or your entire account from the dashboard settings. Deletion is immediate and permanent.
We use a minimal number of third-party services:
No visitor analytics data is shared with any sub-processor.
If you discover a security vulnerability in Clickport, we encourage responsible disclosure. Please report it to security@clickport.io.
The following are in scope: services on clickport.io, the tracker script, and the API.
Out of scope: automated scanner reports, social engineering, denial of service attacks, third-party service vulnerabilities, and issues requiring physical access.
Security research conducted in good faith and in accordance with these guidelines is considered authorized. We will not pursue legal action against researchers who follow this policy.
For more details on how we handle data:
For security questions or concerns, contact us at security@clickport.io.
Last updated: February 21, 2026.