What we record.

The short version

• We never store your visitors' internet addresses. At the door it becomes a city, a network name and a scrambled marker, and the address itself is dropped. It is never sent to anyone.
• No cookies, and nothing typed is read. The snippet never sees what anybody writes into a form, only that a form was started or sent.
• It stays off when asked. A browser that sends the Global Privacy Control signal is not counted at all.
• The free count never touches your ads, and we never sell or share anything, to anybody.

What the snippet records on a visit

• The page the visitor landed on, without anything after the question mark.
• Where they came from: the address of the page that sent them.
• The mark an ad platform added to the link when they clicked, such as Google's gclid, and any campaign tags on it.
• How long the page was on screen, how far it was scrolled, and how many pages the visit saw.
• Whether a form was started, whether one was sent, and whether a phone number was tapped.
• The browser's own description of itself, which says the kind of device and browser, not who is using it.

To tie the pages of one visit together, the snippet keeps a random visit number in the browser tab's session storage. It is not a cookie, nothing else can read it, and the browser throws it away when the tab closes.

What happens to the visitor's internet address

It is used for three things the moment the visit arrives, and then dropped:

• A city. Looked up in a file kept on our own server, so the address never leaves it for this. We keep the city, the region, the country, and a point on the map rounded to about a kilometre. IP Geolocation by DB-IP.
• A scrambled marker. A one-way code made from the address and a secret, so the same visitor on the same site gives the same code for a month and a repeat visit can be counted. It cannot be turned back into the address, it means nothing on any other site, and it changes on the first of every month.
• The network's name. Looked up in a second file on our own server, so the address never leaves it for this either. We keep the network's name, such as a home internet provider, a phone company or a data centre. A visit that arrives from one of the big clouds (Amazon, Google, Microsoft or Meta) or an email security service, or that names itself a crawler, is set aside from the visitor counts and the map, and a paid one is never counted as qualified. A visit through a VPN, Tor or a smaller hosting company is still counted, because people use VPNs too, and the report says how many there were. Besides the network's name, we check the address against public lists of Tor exits and of VPN and hosting addresses, kept on the same server, so the address never leaves it for this either.

What we hold about you, the owner

• Your email address and the web address you signed up.
• Your definition of a visit that qualifies, and what you spend on ads if you choose to tell us.
• Your report link. Anyone with the link can open your report, so treat it like a key. Ask and we change it.
• If you pay: what you bought and when. Card details go to Stripe and never reach us.

If you ask to see your report

"See my report" takes an email address and sends one link to it, so you can open your count again without a password. That link, and the record it makes, live on copycatcheck.com, our sister site, which holds the sign-in for both products: its privacy page says exactly what is kept and for how long. In short: only a one-way hash of the link, deleted after seven days; a record for your address made when you open the link, not when you ask; and that sign-in in your own history, kept a year with the internet address it came from. The answer on screen is the same whether or not that address has anything with us, so the page never says who we hold a report for.

The emails we send you

One line each morning after a day with a visit, and one reminder if the snippet has seen nothing after two days. Beyond that we write only if you pay for more or write to us. Every recurring message carries an unsubscribe link, and it asks once before it takes you off.

Our messages carry a small image that tells us the message was opened. It is not reliable, some mail programs load it by themselves and others block it, and we treat it as a hint. We never rewrite the links in our emails.

Cookies

None. Not on this site, and not from the snippet on yours.

Our security log

That promise is about the visitors to your site. For this site itself, our web server keeps a record of each request (the address it came from, the page, the time and what the browser said about itself) for 30 days, for security, with the codes in private links cut out and no cookies or passwords. To protect it and the people who use it, we also keep a security log. It records what attacks or probes the site, with the internet address it came from:

• anything that fills in a form field no person can see, or writes to an address that exists only to catch scrapers;
• reports from visitors' browsers when our security rules blocked something on one of our pages, or when one of our pages was shown from an address that isn't ours;
• reports from browsers (Chrome and Edge) that couldn't reach this site safely, because they were shown a certificate that isn't ours or sent to a server that isn't ours. Such a report says which page, what went wrong, which server the browser reached and the address it came from.

The log is locked down: only we can read it, it is kept for one year and then deleted. We use it for one thing, finding and stopping anyone who attacks this site or gets between you and it. We don't sell it or share it, except the address of an attacker when we report them to the company hosting them, or what the law requires us to hand over.

Where it lives

On two servers we rent in Germany from Hetzner. Everything in transit is encrypted. The database is copied every night to the second server, and copies are kept for 30 days.

Who else touches it

• Hetzner hosts the servers.
• Resend delivers the email we send you.
• Google hosts our mailbox, so messages you send us arrive there.
• Stripe handles payment, if you buy something.

Nobody else. No analytics company, no advertising network, no data broker.

How long we keep things

• Visits: while your site is with us. Ask and a person deletes your site and every visit recorded for it.
• Your account details: while you are with us, and afterwards for our own records. Ask and we delete them.
• Our web server's request records, for this site itself: 30 days.
• Our security log, for this site itself: one year.
• Backups: 30 days.

Your visitors, and your part

For the visitors to your site, you decide to use ClickCrooks and we count on your behalf. Say so in your own privacy notice: that you measure visits with ClickCrooks, what it records, and a link to this page. If you are in the UK or the EU, you are the controller and we are your processor, and we will sign a data processing agreement if you ask.

What you can ask for

A copy of everything we hold about you and every visit recorded for your site, a correction, or deletion. The visits to your site are your data, kept for your use, and you can have them whenever you ask. Write to hello@clickcrooks.com and a person will do it, usually the same day. We apply the GDPR to everyone, wherever they are, and we do not sell personal information, which covers the CCPA in California.

Children

This is a tool for businesses. It is not for anyone under 16.

If this page changes

We change the date at the top and say what changed. If a change means we would record something new, we ask first.

Who we are

ClickCrooks is a product of ATX Works, an AGI Inc. company, operated by C. Achberger in Austin, Texas. Post reaches us at 13341 W. US Hwy 290, Building 2, Austin, TX 78737. Email is faster: hello@clickcrooks.com.