wiki/_pages/Analytics and Privacy Information.md

title	date_created	date_modified	permalink
Analytics and Privacy Information	Sunday, August 28th 2022, 8:40:43 pm	Sunday, August 28th 2022, 8:40:55 pm	/privacy

We respect your right to block web trackers. We tend to browse with ads and trackers blocked, too.

That said, if you have no adblocker, and JavaScript is enabled, your browser will connect to the cloud-hosted version of GoatCounter, an open-source privacy-focused analytics system. We are not tracking your activity on any 3rd-party sites.

We appreciate knowing which pages on this site are popular. It would be nice if you considered allowlisting this site to allow us to collect metrics.

Here's what we collect:

• View counter for each URL
• Browser
• Browser version
• Device operating system
• Device screen resolution
• Approximate location (municipality as determined by GeoIP lookup)
• Referrers

Goatcounter gives us minimal information about visitors and helps us understand which topics are popular. It would be virtually impossible for us to work back from this data and track down a specific person. Here is a longer explanation:

The GDPR applies to data which “could be attributed to a natural person by the use of additional information”, and does “not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable”.

With the collected data it’s extremely hard to identify a natural person, even by someone with full access to the database (i.e. me).

It’s prohibitively expensive to retrieve the IP address from the hash. The most unique information being stored right now is the full User-Agent header; which can be fairly unique (depending on your browser, especially some mobile ones send a lot of personal information like firmware version) especially when combined with the country, but even this is very limited.

Other information such as the URL or Referer do not relate to an identified person.

It’s true that certain “additional information” from other parties could reveal more – such as correlating the User-Agent and location – but would be hard, and the retrieved data would be limited (everyone in Indonesia using Firefox is a rather large pool of people). To determine whether a personal is identifiable “account should be taken of all the means reasonably likely to be used”, and this doesn’t strike me as reasonably likely.

If a user (i.e. a customer on your site) would contact me for their rights to have insight in their data and/or have it removed, then I would have no way to reliably do so, even if they would provide me with most of their computer’s information. It might be possible if they provide their browsing history, but if you have full access to all their browsing data then what do you need GoatCounter’s data for?