Security

Paczesny Analytics is cookieless by design. The analytics tracker sets no cookies and collects no directly identifying personal data. No raw IP address is stored as part of visitor analytics data; visitors are represented only by a daily-rotating pseudonymous identifier.

The following is an honest account of where things stand, not an unconditional guarantee of legal compliance. It summarizes the reasoning documented in full in our internal self-assessment of the Service's data-protection posture.

We designed Paczesny Analytics to minimize legal exposure by construction, and we describe that design plainly below, alongside what remains genuinely uncertain.

• What we designed for: cookieless tracking that reads and writes nothing on the visitor's device beyond serving the page; pseudonymous, hashed visitor identifiers instead of raw IP addresses; single-site, non-advertising audience measurement; a GDPR legitimate-interest basis (Art. 6(1)(f)); a design intended to fit the general shape of exemptions such as CNIL's audience-measurement guidance (Sheet n. 16).
• What is settled or published guidance: it is settled case law that hashed or dynamic IP addresses are personal data, not anonymous data (CJEU Breyer). GDPR Article 28 sets out our duties as a processor, and Article 82 gives data subjects a direct damages claim; both are settled statute. CNIL Sheet n. 16 and EDPB Guidelines 2/2023 are published regulator guidance: the former is France-specific and narrowly scoped, while the latter creates an unresolved tension with the idea that cookieless tracking never needs consent.
• What remains open: whether ePrivacy Article 5(3), and Poland's equivalent PKE rules, apply to reading a visitor's IP address and user agent for cookieless analytics is untested. No Polish supervisory authority (UODO) ruling exists on cookieless analytics. Germany's DSK has taken a position leaning toward requiring consent for this kind of device access. No regulator has approved or endorsed any specific cookieless-analytics tool, including ours.

Because these questions are open and differ by jurisdiction, each customer decides for itself whether its own use of the Service requires visitor consent in the jurisdictions where its own visitors are located. This page is informational context, not a legal opinion on your own obligations.

The visitor identifier is derived server-side as a salted hash of the site ID, IP address, user agent, and a salt that rotates every UTC day: sha256(siteId + ip + user-agent + daily salt). Because the salt changes daily and the inputs are not retained, the same visitor cannot be linked across days and the identifier cannot be reversed to an IP address.

This section restates the exact visitor-counting mechanism referenced throughout this page and on our Privacy Policy, so it reads identically wherever it appears.

The visitor identifier is a server-side hash of the site ID, IP address, user agent, and a daily-rotating salt: sha256(siteId + ip + user-agent + daily salt).

• Salt rotates every 24 hours, on a UTC day boundary.
• Raw IP address is never stored as part of visitor analytics data; the identifier cannot be reversed or linked across days.
• Retention: raw events are kept for 30 days, then only aggregated data remains.
• Hosting: EU only, on Oracle Cloud Infrastructure in the eu-amsterdam-1 (Amsterdam) region, with no transfer outside the EU/EEA.

Every connection to the service (the dashboard, the ingestion endpoint, and the API) is served exclusively over TLS. Plaintext HTTP is redirected to HTTPS.

Sensitive credentials are encrypted at rest. Google OAuth refresh tokens are stored using AES-256-GCM authenticated encryption, and database storage is protected at the infrastructure layer.

The service runs on self-hosted infrastructure on Oracle Cloud Infrastructure under our direct control, in the Amsterdam, Netherlands region (eu-amsterdam-1), within the EU/EEA. We do not hand your data to third-party managed analytics platforms.

Access to the dashboard requires authentication, and two-factor authentication (MFA) is available. Application data is scoped to the account owner, and sensitive collections are reachable only through administrative service accounts on the server, never directly from the browser.

Raw event data is retained for 30 days and then deleted by an automated retention process; aggregated analytics are kept until you delete the site or the account. The alert delivery log is retained for 90 days. Records of legal acceptance are retained for as long as necessary to evidence that acceptance (GDPR Art. 17(3)(b)).

In the event of a personal data breach, we notify affected customers without undue delay and within 72 hours of becoming aware, consistent with our Data Processing Agreement. Breach reports and security concerns can be sent to bartek@paczesny.pl.

If you discover a security vulnerability, please report it to bartek@paczesny.pl and allow us a reasonable period to remediate before any public disclosure. We aim to acknowledge reports within five business days.

Our current certification status is described below.

We do not currently hold SOC 2 or ISO 27001 certification. These certifications require significant sustained investment and are revisited when enterprise contract requirements demand them. Our security posture is described in full on this page.

We engage a limited set of sub-processors and impose data-protection obligations on each of them. The current list, with purposes and locations, is published at /sub-processors.

The analytics tracker uses no cookies. The only cookie the service sets is a technical session cookie required to keep you signed in to the dashboard.

Related documents: our Privacy Policy, Terms of Service, Data Processing Agreement, and Sub-processors list.