Privacy & data handling

How GhostPane measures traffic, and what it does and does not keep.

The short version

GhostPane sets nothing on the visitor's device — no cookie, no local storage, no device identifier of any kind. It does not build a profile of a person across days or across websites, and it shares nothing with any third party, because the data never leaves the operator's own infrastructure.

What is collected

For each pageview, the following is recorded:

• The page address (path and query string), and the host of the referring site — never the full referring URL, which can contain search terms or tokens.
• Country and region, resolved at the network edge. No finer location is requested or stored.
• Device type, browser and operating system, in broad categories.
• The browser's preferred language, as a two-letter code.
• Any UTM campaign parameters already present in the link.
• A timestamp, and how long the page was actually visible.

What is never collected

• No IP address is stored. It is used only as input to a one-way hash, described below, and then discarded with the request.
• No cookies, no local storage, no session storage, no device fingerprinting — no canvas, font, or audio probing.
• No form contents, no keystrokes, no session recording, no heatmaps.
• No cross-site identifiers, and no data sold, shared or sent to any advertising network.

How a visitor is recognised without a cookie

To tell whether two pageviews came from the same person, GhostPane computes a hash of the IP address and user-agent, salted with a secret that is different for every site and regenerated every day. The salt is derived at the moment of use and never written down.

The consequence is deliberate: within one day the same visitor produces the same identifier, so sessions and visitor counts are accurate. On the next day the salt has changed, so the same person produces a completely different identifier that cannot be linked to the previous one — not by the operator, and not by anyone who obtains the database. The identifier is also scoped per site, so the same person visiting two sites is two unrelated identifiers.

This is why a visitor who returns on several days is counted once per day. That is the most accurate figure this design can produce, and producing a more flattering one would require exactly the long-lived identifier the design exists to avoid.

Consent

Because nothing is stored on or read from the visitor's device, the rules that require consent for cookies and similar storage (in the EU, the ePrivacy Directive as implemented nationally) do not apply in the way they do to conventional analytics. Data protection law still applies to the processing itself, and the operator of this installation remains the controller for it. This page is a technical description, not legal advice — operators with a specific obligation should confirm their own position.

Retention

Two kinds of data are kept, on different schedules:

• Aggregate totals — rows of the form "on this day, this page had 412 views". These describe no individual and are kept indefinitely, since they are the historical record.
• Row-level pageviews — used only for filtered views in the dashboard, and carrying the daily-rotating pseudonymous identifier. These are deleted automatically after 60 days, and can be switched off entirely per site.

Where the data lives

In the operator's own Cloudflare account, in a D1 database and in per-site edge storage. Cloudflare acts as the infrastructure provider. No other processor is involved, and there is no GhostPane company holding a copy — this is software the operator runs, not a service they subscribe to.

Two ways a site can be measured

By default, measurement happens in the browser: a small script reports each pageview. A site's operator can also enable edge mode, where the pageview is recorded as the page itself is requested from the server, with nothing asked of the browser at all.

Everything above applies identically to both. The same fields are recorded, the same one-way daily identifier is computed from the same inputs, and nothing is written to or read from the device in either case — there is no cookie or storage in edge mode precisely because it never involves the browser.

One difference matters and is stated plainly: because edge mode does not depend on a script running, blocking scripts or disabling JavaScript does not prevent measurement on a site that has it enabled. The purpose is accurate counting rather than evading a preference, and what is counted does not change — but a visitor who assumes a blocked script means no measurement would be assuming wrongly.

Opting out

Setting ghostpane_ignore to 1 in a browser's local storage stops that browser being measured on any site running GhostPane. Standard tracker-blocking extensions and browser protections also block the script, and it is not designed to evade them.

Both of those act on the script, so neither applies where a site has enabled edge mode: that measurement happens on the server, before anything in the browser could refuse it. Sites that need certain visitors or areas excluded there do it by path, in the site's own configuration.

If you buy GhostPane from us

Everything above is about the people who visit a site running GhostPane. This section is about you — the customer — and it applies only to this storefront. Your own installation contains none of it: the tables described here are not part of the software you receive, and it does not report anything back to us. There is one exception and it is deliberate: a button in your dashboard that asks us which version is current. Nothing identifies you in that request, and nothing asks it unless you press it.

What is recorded when you buy and install:

• Your purchase — your email address, which tier you bought, and a masked form of your licence key. Payment is handled by Polar, who are the merchant of record; your card details are theirs and never reach us.
• Your install — the Cloudflare account id it went into, the hostname and the website you set up, which build was deployed, and a step-by-step log of the run including anything that did not work. This is how we can answer "did my domain connect properly" months later, which is not a question your own deployment can be asked.
• How the setup wizard went — which step you reached, how long each took, any error you were shown, and whether the tab was in the background while you were away creating a Cloudflare token. Country, browser and operating system are recorded in broad categories, along with the referring site and any campaign parameters in the link.

What is never recorded, at any point:

• Your Cloudflare API token. It exists only in the memory of the request that uses it, for the length of the install, and is never written to a database, a cache or a log line — not even in an error message. This is why the last screen tells you to delete it.
• Your dashboard password, and your full licence key.
• Your IP address. Country is derived at the edge and the address itself is discarded with the request.
• Anything at all from inside your installation once it is running — no usage, no site list, no visitor data.

Why we keep it: to deliver and support what you bought, and to find out where the installer breaks. Install and purchase records are kept as the commercial history of the sale. The detailed step-by-step logs are deleted after 180 days, and a visit to the installer that never got past the first screen is deleted after 60. Nothing here is shared with anyone, used for advertising, or used to build a profile — and if you want your records removed, email us and we will remove them.

Requests about your data

Because the identifier is one-way, salted with a rotating secret, and never stored alongside anything identifying, it is not technically possible to locate the records belonging to a particular person — including on request. That is a property of the design rather than a policy: there is no key that would make such a lookup possible, for anyone. Requests about data held by a specific site should go to that site's operator.