Privacy

Privacy policy

Last updated 3 November 2026

Who we are

ClickCrumb runs clickcrumb.com and app.clickcrumb.com: website analytics that site owners add to their own websites. Questions or requests about your data: privacy@clickcrumb.com.

People who visit sites that use ClickCrumb

When a website uses ClickCrumb, the tracker records:

• the pages viewed, without query strings or #fragments;
• where the visit came from (for example a search engine, a social network or a campaign link);
• the device type: desktop, mobile or tablet;
• clicks on buttons and links the site owner has marked, and outcomes the site confirms (such as a booking).

ClickCrumb never stores IP addresses or browser user-agent strings. There are no visitor profiles and no fingerprinting, and nobody is followed from one site to another.

No cookies. The tracker stores nothing on visitors' devices, except their consent answer on sites that ask for it. If a site owner leaves out their own visits or opens a test visit, the tracker keeps a small flag for that in the owner's browser. It holds nothing that identifies anyone.

To group page views into a visit, our server combines the IP address and browser with a random key that changes every day. That code is deleted within about 30 minutes of the last page view, is never saved with the analytics, and the IP address is never stored.

Bots and AI agents are identified by their user agent, which is read once to name them and then thrown away. They're kept only as daily counts.

Site owners can leave pages out entirely (for example account or checkout pages), and can turn on consent mode so that nothing is sent until the visitor agrees.

How long it's kept: visitor analytics are deleted after 13 months, and test visits after 7 days. Everything a site has collected is deleted when its owner deletes the site.

Google Search Console data

ClickCrumb reads Search Console data only when a site owner connects it, with Google's read-only scope webmasters.readonly, and only for the one property they choose.

• What we read: aggregate search queries, clicks, impressions and average position.
• It's never linked to a visit or a person, and nothing in Search Console is ever changed.
• The refresh token Google issues is encrypted at rest.
• This data is not sold, not used for advertising, and not used to train AI models.

How to remove access: in ClickCrumb, go to Settings → Search Console → Disconnect, which asks Google to remove ClickCrumb's access. You can also remove it in your Google Account under Security → Third-party connections (myaccount.google.com/connections). Imported Search Console data is deleted with the site.

ClickCrumb's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your ClickCrumb account and the early-access list

• To sign in, we keep your email address and your password, stored only as a hash.
• Signing in sets one cookie that keeps you signed in. It's needed for the app to work and isn't used for anything else.
• Each sign-in records the IP address and browser it came from, to protect your account. It's deleted when that sign-in ends: when you sign out, or after 30 days without use.
• The early-access list keeps an email address and a website only, used only to contact that person about access.
• An invite keeps the invited person's email address until the invite is used or expires.

To be removed from any of these, write to privacy@clickcrumb.com.

Where data is kept

• Cloudflare hosts ClickCrumb. As the network in front of it, Cloudflare sees IP addresses at its edge.
• Neon provides the database where the data above is stored.
• Google is a data source only, and only when a site owner connects Search Console.

ClickCrumb doesn't use an email provider.

Changes

When this policy changes, we update the date at the top. For material changes, we tell site owners before they take effect.