Data, retention and backups
Last updated October 23, 2026
Draft. This page is waiting for legal review and may change before launch.
What we keep, for how long and where. It matches our privacy policy and the code that deletes data. The legal entity that runs Sporetag is not named yet, so this page is a draft.
Where data lives
Sporetag runs on Cloudflare. Accounts, sites, links and profiles are in Cloudflare D1. Page views and clicks are in Workers Analytics Engine. Uploaded logos and our backups are in Cloudflare R2. D1 and R2 encrypt data at rest. We have not pinned the data to one country or region.
How long we keep it
| What | How long | Where |
|---|---|---|
| Raw page views, events and clicks | Up to 3 months | Analytics Engine |
| Daily stats totals | Your plan's history: 30 days on Free, 2 years on paid plans | D1 |
| The salt behind visitor hashes | Replaced daily, deleted within 2 days | D1 |
| Anonymous visitor profiles (Attribution mode) | 90 days after the last visit | D1 |
| Account, sites, links, goals, customer profiles | While your account is open, or until you delete them | D1 |
| Sign-in sessions | Up to 30 days | D1 |
| Sign-in and sign-up attempts | 1 day | D1 |
| Error records (no personal data) | Samples 30 days, counts 90 days | D1 |
| Health checks | 14 days; daily summaries 400 days | D1 |
| Nightly backups | 30 days | R2 |
| Monthly backups | 12 months | R2 |
| Billing records | As long as tax law requires | Stripe |
Backups
- Every night after 03:00 UTC, Sporetag copies its database to a private R2 bucket. We keep each night's copy for 30 days, and the first copy of each month for 12 months.
- Backups leave out sign-in sessions, one-time sign-in links, rate-limit records and the daily visitor salts.
- Contact details in customer profiles stay encrypted inside backups. The key is a Cloudflare secret and is never in a backup.
- Cloudflare also keeps a point-in-time history of the database for 30 days (D1 Time Travel), so we can rewind it to any minute in that window.
- Something you delete can stay in a backup until that backup expires: up to 30 days, or up to 12 months in a monthly copy. If we ever restore a backup, we delete again what was deleted after it was made.
- A restore goes into a separate database first and is checked before anything is replaced.
Errors and uptime
When something breaks, we keep the kind of error, the route (such as /app/s/:id, never the full address), the status and a keyed hash of the account and site. We never keep the request body, cookies, the query string, email addresses or IP addresses with it. Our checks run every 15 minutes, and their results are on the status page.
Who helps us run Sporetag
| Company | What for | When |
|---|---|---|
| Cloudflare | Hosting, database, event storage, backups, email and Workers AI | Always |
| Stripe | Payments | When you pay |
| Google Safe Browsing | Checks short link destinations, the address only | When a link is made, then daily |
| Have I Been Pwned | Checks new passwords against breaches, part of a hash only | When you set a password |
| Google, GitHub | Sign in with them | When you choose to |
| Meta | Conversions a customer sends | When a customer connects it |
| Twilio | Texts from automations (when shipped) | When a customer sets it up |
| Amazon Web Services | Email from a customer's own domain (when shipped) | When a customer sets it up |
| Anthropic | Sporetag Assistant, only if we switch providers | Not today |
The privacy policy says what each one receives.
Deleting your data
What you delete in the app, or everything when you close your account, leaves the live database as the privacy policy says, and leaves our backups as they expire. To close your account or get a copy of your data, email hello@sporetag.com from your account's address.