Trust
TrackWhy is privacy-first analytics. This page is not legal boilerplate bolted on after the fact — it is a precise description of how the product works. If we collected something sensitive, we would have to tell you here. We do not, so we cannot.
Last updated 2026-06-16
For a site running our tracking script, we record the following non-identifying signals about each pageview or event:
The tracking script is roughly 1.7 KB and ships with opt-in web-vitals and error capture. None of the above identifies an individual visitor.
These are the practices that make most analytics tools require a consent banner. TrackWhy uses none of them:
Cookie-consent and ePrivacy banners exist because most analytics store identifiers on the visitor’s device and process personal data. TrackWhy sets no cookies, reads nothing from local storage, stores no IP addresses and builds no fingerprint — so there is no personal data to consent to and nothing to disclose under the ePrivacy Directive’s cookie rules.
Because the data we process is not personal data, our processing does not depend on consent or trigger the consent requirements of the GDPR, the ePrivacy Directive or the CCPA. Where a legal basis is required for the limited, aggregate analytics we run on behalf of a site owner, it rests on the legitimate interest of that site owner in understanding their own traffic — a balancing test that is easy to pass precisely because no individual can be singled out from the data.
We retain aggregated, non-identifying analytics data for up to five years so that year-over-year comparisons remain meaningful, after which it is deleted or further aggregated. IP addresses are never part of this retention because they are discarded the moment a country has been derived.
We use a small number of infrastructure providers to host and operate the service — for example our cloud hosting and database provider, and Stripe for billing and the optional revenue-attribution integration. A current list of sub-processors is available on request from hello@trackwhy.com. [Company legal entity] remains responsible for the data processed on your behalf.
Depending on where you live, you may have the right to access, export, correct or delete personal data we hold about you. Because TrackWhy is designed not to identify visitors, in most cases we simply hold no personal data tied to you. If you are a customer with an account, you can access and export your account data from your dashboard, or contact us to request deletion. To exercise any of these rights, email hello@trackwhy.com.
If we change what TrackWhy collects, we will update this page and revise the date above. Material changes that affect how we handle data will be communicated to account holders.
Questions about privacy or this policy? Reach the team at hello@trackwhy.com. The data controller is [Company legal entity], [Registered address].
See also our Terms of Service and the story behind the product on About.