Transparency
Trust, in one page.
Clycyo handles your visitors' data. You should be able to read every detail of how in less than four minutes — without a salesperson. Here it is.
Data location
🇪🇺 Germany (Hetzner, EU)
Application + Postgres in Falkenstein. CDN edge caches only.
Cookies set by tracker
Zero
`localStorage` for the visitor ID, `sessionStorage` for the session. No cookie banner needed for Clycyo alone.
IP addresses stored
Never
Resolved to country at ingest, then dropped before the row hits disk.
What we collect
Everything stored against a visitor record.
The complete list. If a field isn't mentioned below, we're not collecting it.
- Pageview URL + referrerSo you can see where traffic comes from. Stripped of querystrings starting with `token`, `password`, `secret`, `apikey`.
- Anonymous visitor IDA random 64-bit string stored in `localStorage`. Never shared cross-site. Reset by clearing browser storage.
- Session IDA random short ID stored in `sessionStorage` for the duration of a tab. Drops the moment the tab closes.
- Country (from IP)Resolved server-side, then the IP is dropped. The IP itself is never stored on disk.
- Device, browser, OSParsed from User-Agent at ingest. Generic categories only ("Desktop · Chrome · macOS"), never the full UA string.
- Page-load time + Web VitalsLCP, CLS, INP, FCP, TTFB via the public PerformanceObserver API. No DOM snapshots.
- Click target metadataThe clicked element's tag, ARIA label, visible text (truncated to 80 chars), CSS selector and click coordinates as percentages of the viewport.
- JavaScript errorsmessage + filename + line/column + stack trace. Used for the dev panel.
- Identify payload (only if you call it)Whatever your code passes to `identify(email, props)` — entirely under your control. We never auto-fill this.
What we never collect
The stuff most analytics tools quietly do — that we don't.
- ❌ Visitor IP addresses on diskIPs are seen by the server only long enough to resolve country, then discarded. They are not in the database, not in the logs we retain.
- ❌ Persistent cookiesNo cookies for tracking. The visitor ID is stored in `localStorage`, the session ID in `sessionStorage`. You do not need a cookie banner for Clycyo alone.
- ❌ Browser fingerprintingNo canvas hash, no audio fingerprint, no font enumeration, no `clientId`-style cross-site identifier.
- ❌ Cross-site trackingEach website has its own isolated visitor space. A visitor on `site-a.com` and `site-b.com` is two independent records, even on the same browser.
- ❌ Form input valuesClick events capture the visible text of the clicked element only. We never read the contents of `<input>`, `<textarea>` or contenteditable fields.
- ❌ Session recordings or DOM snapshotsNo replay of pixels. The "replay" in the dev tab is a synthetic reconstruction from the click + pageview events, never a screen recording.
- ❌ Selling, sharing, ML-training on your dataYour data is your data. We do not have an ad business. We do not feed customer data into model training.
Sub-processors
Five vendors. All disclosed.
Every third party that ever touches a byte of your data. We notify you 30 days before adding any new sub-processor.
| Vendor | Purpose | Region | DPA |
|---|---|---|---|
| Hetzner Online GmbH | Application + database hosting | Germany (Falkenstein, EU) | View → |
| Cloudflare, Inc. | CDN, DDoS protection, DNS | Global edge (cache only, no PII at rest) | View → |
| Anthropic PBC | AI journey analysis (only when the user clicks "Analyze with AI") | United States — zero-retention API | View → |
| Stripe Payments Europe | Subscription billing | Ireland, EU | View → |
| Resend | Transactional email (account verification, billing receipts) | United States | View → |
Security postures
The boring, important stuff.
🔒
TLS 1.2+ everywhere
Tracker → API and dashboard → API are HTTPS-only. HSTS preload submitted. No mixed content.
🛡
AES-256 at rest
Database volumes are encrypted with LUKS at the OS layer; nightly Postgres backups are encrypted with age before leaving the host.
🔑
MFA on every privileged surface
Hetzner robot, GitHub org, Cloudflare, Stripe, domain registrar — all behind hardware-key 2FA. No shared accounts.
📜
Audit log on the database
Every admin action against the platform is recorded server-side. Available to enterprise customers on request.
🧯
Incident response < 24h
Customer-impacting incidents are disclosed by email + on /changelog within 24 hours of confirmed root cause. RPO 24h, RTO 4h.
🔁
Backups tested monthly
Postgres PITR with 7-day window. Automated restore-into-staging runs on the 1st of each month.
SOC 2 type II — in progress, target Q4 2026ISO 27001 — planned 2027GDPR · CCPA · DPA ready today
Show your visitors
Embed the “Tracked by Clycyo · no cookies” badge.
A small, animated badge for your footer or status page. Tells visitors that you respect their privacy — and gives Clycyo a friendly backlink. Zero JavaScript, zero tracking, just an SVG link.
HTML — dark badge
<a href="https://clycyo.com" target="_blank" rel="noopener" aria-label="Tracked by Clycyo — no cookies">
<img src="https://clycyo.com/badge-dark.svg" alt="Tracked by Clycyo · no cookies" width="200" height="36" />
</a>HTML — light badge
<a href="https://clycyo.com" target="_blank" rel="noopener" aria-label="Tracked by Clycyo — no cookies">
<img src="https://clycyo.com/badge-light.svg" alt="Tracked by Clycyo · no cookies" width="200" height="36" />
</a>Markdown — for READMEs & status pages
[](https://clycyo.com)One last copy-paste
The tracker. 1.1 KB gzipped. No cookies. No banner.
Drop this once in your <head>. Replace YOUR_TRACKING_ID with the UUID you get after creating a site at /register.
<!-- Clycyo · privacy-first analytics, no cookie banner required -->
<script async defer
src="https://clycyo.com/tracker.js"
data-tracking-id="YOUR_TRACKING_ID"></script>Have a question?
Email a human, get a real answer.
Procurement questionnaires, custom DPA addenda, on-prem deployments, regional residency — write to hello@clycyo.com and we'll come back within one business day.