How JS Stats handles data — both for people who use the dashboard and for visitors to the websites it measures.
Last updated: 2026-08-30
This policy covers two groups, and it matters which one you are:
For each pageview, the following is recorded:
No names, email addresses, form contents or keystrokes are collected. Nothing is read from the page other than its address and title.
Raw IP addresses are never written to the database. An address is used briefly in memory to derive a country code, then reduced to a salted SHA-256 hash and discarded. The salt is generated per installation and is not shared.
We state this precisely rather than calling it anonymous: a salted hash is not reversible without the salt, but it is a hash of a value from a limited range, so we treat it as pseudonymous data and protect the salt accordingly. The hash exists only so the same visitor is not counted twice and so site owners can exclude their own traffic.
In the default cookieless mode, the tracker sets no cookie and writes nothing to localStorage. A visitor is recognised within a day by a server-side hash that rotates every 24 hours, so the identifier cannot follow anyone across days or across sites.
A site owner may switch their site to a persistent identifier, which stores an ID in the visitor's browser for more accurate returning-visitor counts. That is their choice and their responsibility to disclose. The dashboard itself uses one strictly necessary session cookie to keep you signed in, and remembers your theme and language preference locally.
Browsers sending a Do Not Track signal are not recorded. Traffic identified as a bot or crawler — including AI crawlers such as GPTBot, ClaudeBot and PerplexityBot — is kept out of visitor statistics entirely and counted separately, so it never becomes part of anyone's visitor data.
For account holders we store your name, email address and a bcrypt hash of your password (never the password itself). If you enable two-factor authentication we store its secret. If you connect Slack or Telegram for alerts, we store the webhook URL or chat ID you provide.
Statistics are kept until they are pruned by the retention setting that applies to your account, or until you delete the site or your account — whichever happens first. Deleting a site deletes its statistics. Deleting your account deletes your sites and their statistics.
We do not sell data and we use no advertising or analytics trackers of our own. Data reaches a third party only in these cases:
You can export all of your data as a file, and delete your account together with everything in it, from the Settings page — no request or waiting period. If you are a visitor to a measured site and want data about you removed, contact that site's owner: they control it, and we act on their instructions.
If you run JS Stats on your own server, none of your data ever reaches us — there is no phone-home, no licence check and no telemetry. This policy then describes only the software's behaviour; you are the controller of your own installation and responsible for your own policy.
Material changes will be reflected in the "last updated" date above and noted in the changelog.
Questions about this policy: stats@jidanshoppu.com.