Privacy policy
Last updated 3 October 2026
agentlytics by measuremy.site ("agentlytics", "we") is operated by studioarjuna, Kanpur, India. It is website analytics built to collect as little as possible. This policy covers two groups: visitors to websites that use agentlytics, and customers who have an agentlytics account. Questions and data requests: contact us or write to imageapiai@gmail.com.
Visitors to websites that use agentlytics
When a website includes our script, it sends us one small request per page view and per custom event. We use it to count traffic for the website's owner.
| We store | The page path; the UTM source, medium and campaign from the URL; the referring website's domain; the country (worked out by our hosting provider from the connection, not stored as an IP address); the name of the browser and operating system (for example "Firefox" and "Windows", worked out from the browser's request; the request itself is not stored); the time; and, for custom events, the event name and any properties the website owner chose to send. |
| We don't store | IP addresses, full URLs or query strings (other than the UTM tags above), user agent strings, cookies, device fingerprints or anything that identifies a person. |
| Counting unique visitors | We compute a one-way hash of the website, the IP address and the user agent, salted with a secret that changes every day. The hash is stored instead of those values. Because the salt changes daily, a visitor can't be recognised across days or across websites. |
| Cookies and storage | The script sets no cookies and uses no local storage, so no consent banner is needed for it. |
| Bots | Requests from known crawlers and automated browsers are dropped and not stored. |
The website's owner decides to use agentlytics and controls this data; we process it on their behalf. Website owners must not send personal data (such as names or email addresses) in page URLs or event properties.
Customers
- Account: your email address, when you created the account and last used it, and your settings. We sign you in with one-time links or codes sent to your email; we store only hashed tokens and sessions.
- Your sites: the domains you add, their keys (secret read keys are stored only as hashes), and the analytics described above.
- Payments: handled by Dodo Payments, which acts as merchant of record and processes card details, taxes and invoices. We receive and store your customer and subscription ids, plan and subscription status, never card numbers.
- Contact form: what you send us, plus a one-way hash of your IP address used only to limit spam.
- Icons in the dashboard: your browser loads country flags from flagcdn.com and brand and browser logos from Simple Icons (cdn.simpleicons.org). Those services can see your IP address and which icons are requested; we send them no referrer and none of your data.
- Our own website: measuremy.site is measured with agentlytics itself, under the same rules as any other site.
How we use data
Only to provide the service: showing website owners their analytics, detecting and explaining traffic spikes, suggesting growth actions, sending account emails (sign-in links and codes, the weekly summary you can turn off, account and billing notices), billing, support, and keeping the service secure. We don't sell data, show ads, or build profiles of visitors.
Spike explanations are written by an AI model running on our hosting provider (Cloudflare Workers AI). It receives aggregated numbers and the names of sources, pages and events, never data about individual visitors.
Who processes data for us
- Cloudflare: hosting, database, email delivery and AI models. The primary database is in Cloudflare's Asia-Pacific region; requests are handled across Cloudflare's global network.
- Dodo Payments: payments, taxes and invoices for paid plans.
How long we keep it
- Individual page views and events: 400 days. Hourly totals and detected spikes: until the site or account is deleted.
- Free accounts unused for 90 days (no sign-in and no use from a coding agent) get an email warning and are deleted 14 days later, with all their data.
- When you delete a site or your account, its data is removed from our database immediately. Copies may remain in our hosting provider's point-in-time backups for up to 30 days.
- Contact form messages: up to one year. Sign-in links and codes: expire within minutes and are removed within a day.
Public dashboards
A website owner can choose to make their dashboard public. Anyone with the link can then see that site's aggregated traffic, spikes and their causes. It never includes data about individual visitors. The owner can make it private again at any time.
Your choices and rights
- Export your account data (JSON) from the Account page, and each site's raw page views and events (CSV) from the site's Setup tab.
- Delete a site from its Setup tab, or your whole account from the Account page.
- Turn off the weekly summary email from the Account page or the link in any summary.
- Visitors who want to know about data for a particular website should contact that website's owner, who controls it. We'll help them respond.
- For anything else, including access, correction or deletion requests, contact us.
Security
All traffic is encrypted in transit. Sign-in tokens, sessions and read keys are stored only as hashes. Access to production data is limited to what's needed to run and support the service.
Children
agentlytics accounts are for businesses and people aged 16 and over.
Changes
We'll update the date above when this policy changes, and email customers about significant changes before they take effect.