Privacy policy

Triember Studios LLC runs emberbee. Write to support@emberbee.app with any question about this policy or your data.

A site owner adds the emberbee script to their site to count visits. The site owner decides to collect this data, so they are the controller. We process it for them under our data processing agreement.

For each pageview or custom event, we store:

• The path of the page, such as /blog/hello. We drop the rest of the URL, except the utm_source, utm_medium, and utm_campaign values.
• The host name of the site that linked to the page, such as news.ycombinator.com, if it is a different site.
• The event name, and any custom properties the site owner sends with it.
• Your country, region, and city. Our hosting provider looks them up from your IP address and passes them to us.
• Your preferred language, from the top choice in your browser's language settings.
• Your browser, operating system, and device type, read from your browser's user agent.
• The time of the event.
• A visitor id.

The visitor id is a one-way hash of the site, your IP address, and your user agent, mixed with a secret that changes every day at midnight UTC. It lets us count unique visitors for one day. You get a new id the next day, and a different id on every site. We cannot turn the id back into your IP address.

We do not:

• Set cookies, or write anything to your device.
• Store your IP address or your full user agent.
• Store full URLs, query strings, or page fragments.
• Follow you across sites or across days.
• Sell data, or use it for advertising.

Requests from known bots and crawlers are dropped and never stored.

The visitor id does not identify you, and we cannot find your events from your name or email. To ask about the data a site collects, contact that site's owner. To stop being counted, block the script in your browser.

When you create an account and use emberbee, we store:

• Your account. Your email address and name. If you sign in with Google or GitHub, also your profile picture and the account id, sign-in tokens, and permissions that provider gives us.
• Sign-in codes. We email you a code to sign in. We store only a hash of the code, and it expires after 10 minutes.
• Sessions. For each device you sign in on, a session token, its expiry time, and the device's IP address and user agent.
• Your sites. Each site's name, domain, and time zone, who can see it, and the analytics events it collects.

We use this data to run emberbee for you, to keep your account secure, and to email you about your account. We rely on our contract with you, and on our legitimate interest in keeping the service secure.

emberbee.app counts its own visits with emberbee, under the same rules as any other site.

We share data only with the companies that help us run emberbee. They are listed on the subprocessors page. We do not sell personal data.

• We keep your account data while your account exists.
• We keep a site's events for 3 years, then delete them. The site owner can delete them sooner, delete the site, or delete their account.
• If an account has no plan when its free trial or subscription ends, we stop saving its sites' events 7 days later and delete the events it has 60 days later. We email the owner 7 days before the deletion.
• When you delete your account in Settings, we delete it with its sessions and connected sign-in accounts, and every site you own with all of its events.

Our database runs in the United States. If you are in the EU, the UK, or Switzerland, we transfer your data under the European Commission's Standard Contractual Clauses or an equivalent safeguard.

You can ask to see, correct, export, or delete your personal data, or object to how we use it. You can do most of this yourself. Change your name in Settings, export a site's events as CSV from its settings, and delete your account in Settings. For anything else, write to support@emberbee.app. You can also complain to your local data protection authority.

When we change this policy, we update the date at the top. If a change matters to you, we will email you before it takes effect.