Privacy and security

Punchline measures software behavior in detail and keeps people anonymous.

What we collect on your site

Collected	Not collected, ever
Page path and host; utm_* values (other query parameters removed, emails in URLs replaced)	Cookies, local storage, device identifiers
Referrer host only	Full referrer URLs
IP address and user agent, used in memory then discarded	Stored IP addresses or user agents
Country code	Precise location
Response status and size (Cloudflare install)	Form contents, search terms, request bodies
Optional browser snippet: page views; agent signals as counts only (off for EU/UK visitors unless you turn it on)	Keystrokes, text, pointer positions, session recordings
Company domains your server sends with events (acme.com), linked to a visitor's day	Email addresses: only the domain is kept; personal mail domains are ignored

Visitors are grouped within a day by a salted one-way hash; the salt is deleted daily. Browsers sending Global Privacy Control get no hash at all. To stop floods of fake page views, the browser snippet's collector also counts requests per network address for one minute, in server memory only, under a salted hash whose salt never leaves that server; it's never written to storage.

Retention and location

• Individual page-view records: 90 days, then deleted. Daily totals are kept.
• Data is stored in the United States (Oregon). EU hosting is planned.

Sharing outside your dashboard

Through the API, MCP and share links, groups with fewer than 5 people's page views are withheld, and sessions of people are never returned. Agent data is shown in full.

Subprocessors

Who	Why
Vercel	Hosting (United States)
Supabase (AWS us-west-2)	Database and dashboard sign-in
Google Analytics Data API	Only if you connect GA4: read-only daily totals
Anthropic	Only when you use Ask Punchline (aggregate tool results) or the docs assistant (your question and excerpts from these docs): writes the answer; no training on this data
Resend	Only if you add email addresses for alerts: sends the daily digest
Slack	Only if you add a Slack webhook for alerts: receives the daily digest
Google Cloud	Only if you export to BigQuery: runs the daily load jobs into your dataset
Stripe	Only if you pay for a plan: takes the payment and keeps the billing email, card and invoices. Punchline stores the Stripe customer and subscription IDs, never card details

Integrations you connect (HubSpot, Salesforce, Google Ads, Meta, BigQuery, Snowflake) receive the data you choose to send them, in your own accounts, under your agreements with those companies.

Security

• Data lives in a database schema not exposed to any public API, with row-level security on every table.
• Edge installs authenticate with a per-site secret. API keys, share links and invite links are stored only as SHA-256 hashes.
• Credentials Punchline has to use later are stored encrypted (AES-256-GCM): CRM and ad platform tokens, and the Snowflake private key. Alert destinations (a Slack webhook, or your webhook's URL and signing secret) are stored usable so digests can be sent. None of these are ever shown again or logged.
• Dashboard sign-in by email link; no passwords.

Questions or a data processing agreement: hey@opsscale.co.