Privacy Policy

1. Introduction

XPmetric ("we", "us", "our") is a web analytics platform operated at xpmetric.com. This Privacy Policy explains how we collect, use, and protect your information when you use our service.

2. Data We Collect

When you use XPmetric to track your website, we collect the following analytics data from your site's visitors:

• Page views (URL, page path, timestamp)
• Referrer URLs
• UTM campaign parameters (source, medium, campaign)
• Device type, browser, and operating system
• Country and city (derived from IP geolocation)
• Custom events and revenue data (if configured by site owner)

We do not store raw IP addresses. Visitor identity is determined using a hashed fingerprint that cannot be reversed to identify an individual. This hash rotates daily to prevent long-term tracking.

For your XPmetric account, we store your email address, display name, and profile image (if you sign in with Google).

3. Cookies

We use session cookies strictly for authentication (keeping you signed in). We also use Google Analytics on the xpmetric.com website itself, which sets _ga and _ga_* cookies to measure visitor traffic and usage patterns on our site.

Your site's visitors are never tracked across websites by XPmetric — our tracking script (p.js) uses no cookies and no cross-site identifiers.

4. Payment Processing

Payments are processed by Stripe. We never see or store your credit card number. We only store your Stripe customer ID and subscription ID to manage your account.

5. Data Storage

All data is stored on servers located in Germany (Hetzner, Nuremberg). Your analytics data is stored in PostgreSQL and ClickHouse databases within our infrastructure. Data is encrypted in transit via TLS.

6. Data Retention

• Analytics events are retained for 2 years, then automatically deleted
• Account data is retained for as long as your account is active
• If your subscription expires and the grace period ends, analytics data is deleted (account and site configurations are preserved)

7. Third-Party Services

• Stripe — payment processing
• Google OAuth — optional sign-in method (only if you choose it)
• Google Analytics — website analytics for xpmetric.com (see Google's Privacy Policy)

We do not sell, rent, or share your data with any third parties for advertising, marketing, or any other purpose.

8. Do Not Track

We respect the Do Not Track (DNT) browser signal. When DNT is enabled, our tracking script will not collect analytics data from that visitor.

9. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access — request a copy of the data we hold about you
• Rectification — correct any inaccurate personal data
• Deletion — request deletion of your personal data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to the processing of your personal data

You can exercise many of these rights directly from your account:

• Access & Portability — use the "Export My Data" button in your Settings to download all your data in JSON format
• Deletion — use the "Delete My Account" button in your Settings to permanently remove all your data

For any other requests, contact us at the email below. We will respond within 30 days.

10. Data Export & Account Deletion

You can export all your data at any time from your Settings page. The export includes your profile, sites, event summaries, achievements, and usage history in a machine-readable JSON format.

You can delete your account and all associated data at any time from your Settings page. Deletion is immediate and irreversible — all analytics data, achievements, Stripe subscription, and account information will be permanently removed.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you via email or through the service. Continued use of XPmetric after changes constitutes acceptance of the updated policy.

12. Contact

For privacy-related questions or requests, contact us at privacy@xpmetric.com