Privacy: what we collect

Mosaicdeck is built to give you useful numbers without tracking people. This page lists exactly what's collected from your visitors and your apps. For the legal terms, see the Privacy Policy.

From your visitors (the script)

For each page view, custom event or error, the script sends:

• The page path (for example /recipes/banana-bread), never the query string or fragment.
• The referring site's hostname only, on the first page of a visit. It's dropped if it's your own site.
• utm_source and utm_campaign, if the landing URL has them.
• The window width, which becomes a device class (mobile, tablet or desktop).
• For custom events: the name and properties you choose to send.
• For errors: the message, plus the script file, line and column.

From the request itself, the collector derives:

• The country, from the IP address.
• The browser and operating system family (like “Firefox” and “macOS”), from the user agent. Versions aren't stored.
• A visitor hash: the first 16 hex characters of a SHA-256 hash of a daily random salt, the site ID, the IP address and the user agent. It lets us count unique visitors for a day without knowing who they are.

What we don't do

• No cookies, local storage or other storage in the visitor's browser.
• No stored IP addresses. The IP is used in memory to find the country and compute the hash, then discarded.
• No fingerprinting and no visitor identity across sites or across days. Each day's salt is deleted after 2 days, so hashes can't be linked back to anyone.
• No tracking on localhost or local files, and you can honour Do Not Track withdata-respect-dnt="true".
• No selling or sharing of analytics data, and no ads.

Your responsibility

Don't send personal data, like names or email addresses, in custom event properties, page paths or metric labels. Whether you need a consent notice depends on the laws that apply to your site; we can't give legal advice.

From your apps

• Uptime checks record the status code, response time and any error for the URL you set. The response body is discarded.
• Metrics polling stores the numbers, labels and statuses your endpoint returns. Theprotocol's privacy rules forbid personal data in it.

How long it's kept

Older data is removed every night. When you delete a site or a workspace, its data is permanently purged after a 7-day safety window.

You can download a copy of everything at any time from Account → Export your data: your profile and all the data of the workspaces you own, as JSON lines, with a download link that works for 7 days. Deleting your account (also on the Account page) removes it and the workspaces you own alone after the same 7-day window; signing in again before then restores everything.

Your AI assistant

When you connect an AI assistant over MCP, it can read the workspaces you chose, and nothing else. Text that visitors can write (paths, event names, error messages, labels) is marked as untrusted in what it receives, so it's treated as data.

Where it's processed

Mosaicdeck runs on Cloudflare. The full list of subprocessors is on the Subprocessors page.