Privacy Policy

Aback Analytics is a website analytics and revenue attribution service operated by Aback Group. When you create an account you are the customer, and the people who visit the websites you track are the people whose data we process on your behalf.

Questions about this policy can be sent to privacy@aback.com. That address is a placeholder in this build and should be replaced with a monitored mailbox before the service is offered to anyone else.

When the tracking script runs, it creates one random identifier for the browser and stores it in that browser under the key aback_vid. The value is generated by the browser, it is not derived from anything about the person, and it is not shared with any other site.

The server never stores that raw value. On arrival it converts the identifier into a one way value with a secret key, using a salt that belongs to your website, and stores only the result. The same browser therefore produces different identifiers on different websites, and the value cannot be reversed back into the original one.

Because the identifier lives in the browser, it is a first party value. It is not attached to the person, it does not follow them to another site, and it is not shared with an advertising network.

For a pageview, the server records:

• the page path and the page title;
• the referring site, when the browser provides one;
• the campaign parameters utm_source, utm_medium, utm_campaign, utm_term and utm_content when they are present;
• a coarse device category, browser family, operating system family and screen size class, with no version numbers and no pixel dimensions;
• a coarse country, as a two letter code taken at the edge;
• the one way visitor identifier and the session it belongs to.

For a custom event, the server records the event name and the properties you send. Property keys that look sensitive, such as password, token, secret, cookie, authorization, card number, cvv, email address or phone number, are dropped before anything is stored. A single event may carry at most 20 properties, each string value is truncated to 256 characters, and the total property payload is capped.

For a revenue event, the server records the amount in integer minor units, the ISO currency, the time of the payment, an opaque customer reference that you provide and the attribution context that could be resolved. The browser never sends an amount.

• No IP addresses in analytics data. No event contains an IP address. The address of a client is used transiently at the edge for rate limiting and for the coarse country code, and it is not written to the analytics tables. The sign in session record stores a truncated one way hash of the address that signed in, so it cannot be reversed, and it is not used in any report.
• No form capture. The tracker does not read form values, does not record keystrokes and does not take snapshots of the page.
• No fingerprinting. No canvas hash, font list, audio stack or similar device signal is collected. The device, browser and operating system labels are coarse families, not a fingerprint.
• No cross-site identity. Identifiers are derived per website, so a visitor is not recognised across different properties unless you explicitly configure it.
• No selling or sharing of visitor data. Analytics data is not used for advertising, is not sold, and is not used to train models.

Your account stores the email address you signed up with, a display name, a hashed password and the record of which websites and members the account contains. Passwords are stored as a salted PBKDF2 hash, so they cannot be read back. Session tokens and API key secrets are stored as digests as well, and an API key secret is shown once when it is created.

The tracking script does not set a cookie. It reads and writes two keys in the browser local storage of the site you install it on: aback_vid for the identifier, and aback_optout when a visitor opts out. A visitor who opts out stops sending events from that browser. Deleting the local storage of the site removes the identifier as well.

The dashboard itself uses one session cookie, named abk_session, to keep you signed in. It is marked httpOnly and SameSite, and it holds an opaque token whose digest is what the server stores.

Raw events are kept for the retention window of the plan: 30 days on the free plan, 365 days on Pro and 730 days on Business. Aggregates are derived from those events and are removed with them, so a deleted day does not reappear in a report. When a website is deleted, its events, sessions, aggregates, goals, funnels, API keys and revenue records are removed.

Billing records and audit records of administrative changes are kept for as long as they are needed for contractual, security and legal obligations.

You can export your data and you can delete it. A website export produces the recorded events and aggregates for that website in a documented format, and a website deletion removes the raw events, the derived aggregates and the related configuration. Account deletion removes the account, its websites and its memberships.

If you need an export or a deletion and cannot find the control in the dashboard, write to privacy@aback.com and we will do it for you.

We use the following service providers. Each one processes data only on our instructions.

• Cloudflare provides the application runtime, the database, the object storage, the queue and the edge delivery. Visitor events and account data are stored in their infrastructure.
• Dodo Payments processes subscription payments for Aback Analytics. It receives the payment details needed to take the payment. Aback Analytics never stores card data.

A list of subprocessors with the current details is available on request from privacy@aback.com.

We measure how the product itself is used, so we can tell whether the tracker is installed and whether it works. These events go to one internal website, in one internal account, and are never mixed with the events of a customer website.

The internal events record that something happened, not who did it. They carry a fixed set of names, such as the creation of an account or of a website, and a short list of properties from a fixed set, such as the name of a plan. They never carry a customer address, a customer event payload, a payment detail or the content of a page.

A deployment that is not configured for it sends nothing. The configuration is separate from the configuration of the customer websites, so the telemetry is off unless it is asked for.

Depending on where you live, you may have the right to access, correct, export or delete the personal data you gave us, and to object to certain processing. Ask us and we will help you exercise those rights within the time the applicable law allows.

This policy describes what the software does. It is not legal advice, it is not a compliance certification, and it does not make a claim on behalf of your website. If you need a data processing agreement for your own customers, ask us for the current version.

Aback Analytics is a business tool and is not directed at children. We do not knowingly collect information from children. If you believe a child has sent us information, contact us and we will delete it.

When this policy changes, the date at the top of the page changes with it and the changelog records the change. The changelog is the fastest way to see what moved.

Write to privacy@aback.com with any question about this policy. The address is a placeholder in this build and should be replaced with a monitored mailbox before launch.