Privacy policy

Who we are

Sporetag runs at sporetag.com and go.sporetag.com. You can reach us at hello@sporetag.com for anything on this page.

If you have an account

We keep what we need to run your account:

• Your email address and a hash of your password. We never store the password itself.
• Your sites, goals, short links, domains and settings.
• Your plan and billing status. Stripe handles your card. We never see the card number.
• Sign-in sessions, with the browser's user agent so you can see where you are signed in.
• Short records of sign-in and sign-up attempts, to stop abuse.

We use your email to sign you in, to send account mail like email confirmation and password resets, and for weekly reports you turn on. We do not send marketing mail without asking.

If you visit a site that uses Sporetag

Sites that use Sporetag send us a small record of each page view and event. In Private mode, the default:

• No cookies are set and nothing is stored in your browser.
• Your IP address is used to work out your country, then dropped. It is never stored.
• A visitor hash is made from a daily salt, the site, your IP address and your user agent. The salt is replaced every day and the old one deleted, so you cannot be followed from one day to the next or from one site to another.
• We record the page, the referring site, campaign tags, ad click ids from the address, your country, device type, browser and operating system.

A site owner can turn on Attribution mode. The script then keeps a random id and ad click ids on that site's own domain for 90 days, so a later sale can be tied to an earlier ad or link. The site owner is responsible for asking your consent where the law requires it.

If a site owner sends us your email or phone number with an order, we turn it into a SHA-256 hash on arrival and keep only the hash. We send that hash to Meta only if the owner connected Meta and marked that goal to be sent.

If you click a short link

A click on a Sporetag short link records the link, the time, the referring site, your country, device type and browser. Your IP address is not stored. If the link leads to a site the same customer tracks, we add a link id to the address so the visit can be tied to the click.

Our own website

sporetag.com is measured with Sporetag in Private mode. We set two cookies only when you use the account pages: st_session keeps you signed in for up to 30 days, and st_csrf protects forms. Your light or dark theme choice is kept in your own browser's storage.

Who helps us run Sporetag

• Cloudflare hosts the service, the database, the event storage and our email.
• Stripe handles payments.
• Google Safe Browsing checks short link destinations for malware and phishing. Only the destination address is sent.
• Have I Been Pwned checks new passwords against known breaches. Only the first five characters of a hash of the password are sent.
• Meta receives conversions only when a customer connects the Meta Conversions API.

We do not sell personal data. We do not use it for advertising.

How long we keep data

Stats are kept for as long as the customer's plan allows: 30 days on Free and 2 years on paid plans. Account data is kept while the account is open. When you close your account, we delete your account data. Billing records are kept as long as tax law requires.

Your rights

You can ask to see, fix, export or delete the personal data we hold about you. Email hello@sporetag.com from the address on your account. If you visited a site that uses Sporetag, contact that site first: they decide what is measured. We hold no IP address or cookie that could find you, so in Private mode we usually cannot single out your visits.

Changes

If we change this policy in a way that matters, we will email account holders before it takes effect and update the date at the top.