Legal

Privacy policy

Last updated 28 October 2026

What Whotrack records, about whom, who else handles it, how long it is kept, and how to have it deleted.

Who we are

Whotrack is the service at whotrack.com, app.whotrack.com and c.whotrack.com. It records visits to its customers’ websites and labels each one human, bot or unknown, with the evidence behind the label. The operator responsible for it (“we”) is Whotrack.

We have two roles. For your Whotrack account, we decide what is collected and why. For the visits Whotrack records on a customer’s website, that customer decides, and we process the data on their behalf.

If you use Whotrack

When you have an account, Whotrack keeps:

• your email address, the date you signed up and, if you answered it, how you heard about Whotrack;
• sign-in links and signed-in sessions, stored only as hashes. A link works once and expires after 15 minutes. A session lasts 30 days and is extended while you use the dashboard;
• the websites you add, their names and addresses, and everything recorded for them, as described in the next section;
• for the email images you create, the recipient name, email address and subject, stored exactly as you typed them;
• your plan, its status and dates, your Creem customer and subscription IDs, your event counts for each month, and the billing events Creem sends us. Those events hold Creem’s IDs, statuses, dates and amounts. Before an event is stored, the name, email address and country on your Creem customer record are removed from it.

The sign-in form uses Cloudflare Turnstile to check that a person is asking for the link, and we send Cloudflare your IP address with that check. We also count sign-in requests per IP address and per email address, in memory only, to limit how many each can make in an hour.

We email you sign-in links, notices about your trial, your payments and your monthly usage, and a confirmation when you delete your account.

If you visited a website that uses Whotrack

The owner of that website is a Whotrack customer and decides to record its visits. Whotrack processes this data on the owner’s behalf and follows their instructions. To see, correct or delete data about your visit, ask the owner of that website.

The tracker respects Do Not Track and never reads what people type into forms. As evidence for each verdict, it counts input events: clicks and taps, key presses, mouse or pen movement, and scrolling with a wheel or touch. It does not record which key was pressed or what a field contains.

The tracker sets no cookies. It keeps a random visitor ID in the browser’s session storage for that tab. It keeps that tab’s input counts there too, so evidence adds up across pages. Whotrack stores a keyed hash of the visitor ID, not the ID itself.

For each page view and event, Whotrack stores:

• the time, the page’s path without its query string, and the page title;
• the page the visitor came from, without its query string;
• campaign tags from the page address: utm_source, utm_medium, utm_campaign, utm_content, utm_term and ref;
• the browser’s user agent, and the browser, device and operating system read from it;
• an approximate country;
• evidence for the verdict: the input counts above, how far down the page the visitor scrolled, how long they were active on it, and markers that browser automation tools leave;
• links followed to other websites and files downloaded, as addresses without their query strings;
• events and conversions the website sends, with their names and properties. Properties with common sensitive names, such as email, phone, password or token, are dropped;
• the verdict, human, bot or unknown, and the reasons for it. A verdict is an inference from the evidence and can be wrong.

From ad click IDs such as gclid and fbclid, Whotrack keeps only which one was present, not its value.

Website events are stored without the visitor’s IP address. Whotrack uses the address to look up an approximate country, with a country database that runs on our own server, so the address is not sent anywhere for the lookup. It also counts events per address, in memory only, to limit how many one address can send to a website each minute.

A website can also report visits from its own server. Whotrack then receives the visitor’s IP address, user agent and page from that server, and keeps a few facts read from the request’s headers, such as whether it asked for a web page and whether it carried a language preference. Cookie and authorization headers are ignored. When such a visit comes without a visitor ID, Whotrack groups its requests by a keyed hash of the website, the IP address and the user agent, and stores that hash instead of the address. Do Not Track does not cover visits a website reports from its own server: those are recorded whatever the browser sends.

Customers can also put an image in the emails they send. When the image loads, Whotrack stores the time, what kind of client asked for it (an image proxy, a declared bot or unknown), its user agent and an approximate country. It does not store the IP address: it uses it to look up the country, except for a known image proxy, and in memory only to limit how many loads one address can record each minute. The recipient’s name, email address and the subject are whatever the sender typed when creating the image. An image load does not prove that a person opened the email.

whotrack.com

This website uses Whotrack and nothing else: no other analytics, advertising or social media scripts, and its fonts are served from whotrack.com. Whotrack sets no cookies on it. Visits here are recorded as described above, with us as the website owner.

Cookies

The tracker sets no cookies, and Whotrack sets and reads none on c.whotrack.com. Cloudflare, which sits in front of our hosts, may set its own cookies for network protection.

The dashboard at app.whotrack.com sets one cookie, wt_session, when you sign in. It keeps you signed in, scripts on the page cannot read it, and it lasts 30 days, renewed as you use the dashboard. Signing out removes it.

The dashboard also keeps two items in your browser’s local storage: the website you last selected, and, while you wait for a sign-in email, the dashboard page you started from, which is removed once you sign in. Cloudflare Turnstile on the sign-in form may store what it needs to run its check.

Service providers

Each one handles data only for the job named here:

• Hostinger runs our servers and hosts our support mailbox.
• Cloudflare provides our DNS and network protection, so requests to whotrack.com, app.whotrack.com and c.whotrack.com pass through it. It also runs the Turnstile check on the sign-in form.
• Resend sends our emails: sign-in links and account notices.
• Creem takes payments on its own checkout page. Card details are entered there and never reach Whotrack. Creem sends us the billing events described above.

These providers may process data outside your country, including in the United States. We do not sell personal data, and we share it only with these providers or when the law requires it.

How long we keep data

• There is no automatic expiry. Visits, events, goals and email records stay until their website or your account is deleted.
• For each email image, the first 500 loads are stored. After that, only the total and the time of the last load are updated.
• Expired sign-in links and sessions are deleted the next time someone asks for a link or signs in.
• After an account is deleted, we keep two records: the billing events Creem sent for it, with the name, email address and country on the Creem customer record removed; and its Creem subscription’s ID with the date of deletion. Nothing removes these records automatically. The record of the deletion confirmation email, which holds the account’s email address, is deleted once the email is sent, or after ten failed attempts to send it.
• Deleted data is overwritten in the database file. It can remain for a short time in the database’s write-ahead log, and in any backup copies of the database until those copies are replaced.

Your choices

If you have an account, you can export a website’s visits as CSV from the dashboard, and delete your account with all its data from Settings. The data deletion page explains what goes and what stays. You can also ask us for a copy of your personal data, or ask us to correct or delete it, by writing to support@whotrack.com from your account’s email address. We reply within 30 days.

If you visit websites that use Whotrack, turning on Do Not Track in your browser stops the tracker from recording you. Visits a website reports from its own server are still recorded. For data already recorded, ask the owner of the website.

Children

Whotrack is a tool for businesses and is not meant for anyone under 16.

Changes

If we change how we handle personal data, we update this page and its date. If the change matters and you have an account, we email you before it takes effect.