Privacy controls and data handling
Facts reviewed:
For the notice covering the hosted service, read the Privacy Policy. This technical guide explains collection defaults, browser storage, hosting, and retention behavior.
Visitor analytics and Console accounts are different
Section titled “Visitor analytics and Console accounts are different”The analytics SDK does not write cookies, local storage, session storage, IndexedDB, or a persistent browser identifier. This applies to npm imports and all CDN bundles. Requests omit browser credentials. Bounded campaign tags are automatic in SDK 1.0.3; arbitrary query parameters and URL fragments remain excluded by default.
Page paths, event names, permitted custom properties, browser/device information, approximate location, and enabled performance measurements can be collected. Integrators choose which custom events and rules to send. Never include passwords, payment details, email addresses, free-form messages, or other personal information in those fields.
The API uses the incoming IP address in memory for location lookup and identifier derivation. Raw source IPs are not stored in analytics facts. Network providers can still process IP addresses when handling requests; this is not a promise that an IP never reaches infrastructure.
The server derives site-scoped pseudonyms from a reduced IP prefix and browser information. Visitor pseudonyms can remain stable across days while those inputs and the server salt remain unchanged. User pseudonyms rotate daily; session pseudonyms use fixed 30-minute buckets. They are estimates that can merge different people or split one person’s activity. Cookie-free does not mean anonymous or impossible to relate to other information.
Console accounts use email, profile information, team memberships, and authentication records. Secure HttpOnly cookies keep you signed in. Console uses Web Locks to coordinate session refresh across tabs, with local storage sharing completion and expiry timestamps; it does not store login credentials or identify visitors on tracked websites.
How identifiers are derived
Section titled “How identifiers are derived”The API uses keyed BLAKE3. A key is derived from the server’s persistent secret salt with the context owleye privacy identifiers v1. Each input is separated with a zero byte, and each identifier uses its own domain label:
| Identifier | Domain and inputs | Lifetime |
|---|---|---|
| Visitor | visitor-v1: tracking ID, reduced IP prefix, User-Agent string, SDK timezone |
Stable while these inputs and the secret remain unchanged |
| Daily user | daily-user-v1: tracking ID, visitor hash, UTC date |
Changes each UTC day |
| Session | session-v1: tracking ID, visitor hash, floor of Unix seconds divided by 1,800 |
Fixed 30-minute buckets |
IPv4 is reduced to a /24 prefix and IPv6 to /64 before hashing. Neither raw nor reduced IP addresses are written to analytics facts. User-Agent strings are parsed into browser, operating-system, and device fields; the raw string is not stored with events. The root salt is persistent server configuration, not a daily salt that is automatically destroyed. It must remain secret and is not sent to the browser. This provides site separation and reduces collection; it does not make the data inherently anonymous.
Hosting and services
Section titled “Hosting and services”The published Privacy Policy identifies AWS in Ireland (eu-west-1) as the primary API and database region, matching the documented deployment configuration. That is the published hosting commitment, not an independent verification of live AWS resources. It does not describe every location in which a service provider may process data.
The October 21, 2026 review checked the application integrations, deployment documentation and public service endpoints. It confirmed public website and Console delivery through Cloudflare, API database readiness and the Better Stack status page. It did not independently verify live database placement, payment completion, email delivery or backup restore results. See hosting verification for the observations and limits.
| Service | What it does and the information involved |
|---|---|
| AWS | Primary API and database hosting in Ireland, as identified in the published privacy notice and deployment documentation. |
| Cloudflare | Serves the website and Console and handles delivery/security at the edge. Requests can include IP addresses, URLs, and HTTP headers. |
| Dodo Payments | Checkout and subscription integration. When used, OwlEye sends customer and purchase details and receives billing identifiers and subscription status. |
| Better Stack | Publishes the service status page for the listed API, Console and website checks; receives configured endpoint URLs and check results. |
| Resend | Supported sign-in and transactional email integration; SMTP delivery is also supported. The configured delivery provider receives recipient addresses and message contents. |
| MaxMind | GeoIP database integration for approximate location. Configured database lookups run locally on the API server; a visitor’s IP is not sent to MaxMind for each lookup. |
| When Google sign-in is enabled and selected, provides the account identifier, verified email, and profile information needed to sign in. | |
| OpenRouter and the selected model provider | When AI is used, receive the question, clarification context, bounded event/catalog information, and aggregate reports needed to answer. |
AI requests require provider routing with zero retention and data collection disabled. That is a request configuration, not a blanket claim about all provider operations. Avoid sending personal information or secrets in questions. See AI data handling.
An account-level AI security block can retain the exact blocked input as encrypted incident evidence for restricted security review. That evidence expires after 90 days and is removed by scheduled cleanup; the account’s block reference can outlive the evidence. This security evidence is separate from visitor analytics and provider routing.
These providers have their own processing locations and policies. A primary hosting region of Ireland does not mean that email, billing, edge delivery, support, or AI processing stays exclusively in Ireland.
Collection choices
Section titled “Collection choices”Global Privacy Control suppresses SDK tracking by default. Do Not Track is no longer consulted. The ingestion API does not filter DNT or GPC headers; integrations must apply collection choices before sending events, including server-side events. Site operators remain responsible for the notices and collection choices appropriate to their sites.
To wait before collecting:
import { useAnalytics } from "@owleye/analytics";
const analytics = useAnalytics("your-site-id", { autoStart: false });
// Call only after the site has made the required collection decision.analytics.start();
// Stop collection for this page.analytics.stop();Retention, export, and deletion
Section titled “Retention, export, and deletion”Hosted analytics retention depends on the confirmed plan. Free has 12 calendar months of active analytics, Pro has 24 calendar months, and Business has 36 calendar months. Expired facts leave ordinary reports before asynchronous deletion completes. Grace periods and the reconciliation schedule are explained in the retention table.
Account holders can export their account/control-plane information. App owners can export bounded analytics data and request app deletion. Account deletion requires resolving ownership of apps and organizations first. Removing live data does not instantly remove separate backups, logs, payment records, or provider records.
For a privacy or deletion question, email privacy@owleye.dev. If you are a visitor to a website using OwlEye, contact that website’s operator first: they choose what they collect and control access to that site’s analytics.