Company
Security
This page describes the controls in the product today. It is not a security certificate, and it is not a substitute for your own review.
Accounts
A password is stored as a hash. The password itself is not stored. Signing in uses a session cookie. Forms that change the account include a token that must match the page, so a form posted from another site is refused. A new account stays closed until the confirmation email is opened. That link expires after 48 hours. A password reset link expires after 60 minutes.
The tracking script
The script on a website contains only a public site key. It does not contain a private secret. Collect accepts an event when the request origin matches the registered domain. A key can be rotated from website settings if the snippet needs to be replaced. The collect and site-config endpoints are rate limited.
What a visit record holds
A page view can include the page path, page title, referrer origin, campaign tags, device, browser, operating system, country, and hashed visitor and session ids. The hash uses a salt that belongs to that site. Country is taken from the visitor address when the visit starts, and the address is not written to the analytics tables. City is not collected. Search queries are not taken from referrers. Details are on the privacy page.
Choices on a website
Honor Do Not Track is on when a website is created. When that setting is on and the browser sends the signal, the event is ignored. A path exclusion such as /admin also skips its subpages. An excluded IP address is not written as a page view. Deleting a website removes that site’s analytics.
Payments and the contact form
Checkout is Razorpay, in Indian rupees or US dollars. Rupee prices add 18% GST. Dollar prices have no GST. We store the payment status, the plan end date, and the Razorpay reference. We do not store the card number. Enterprise is not charged through that checkout. The contact form asks Cloudflare Turnstile to reject an automated message before the note is emailed. Registration, password reset, and the contact form are rate limited.
What this page does not claim
WebTrackNext does not publish a SOC 2 or ISO certificate. The product is not described as EU-hosted, cookie-free, or anonymous. The tracking script can keep a visitor id in the browser so a return visit on that same site can be recognized. Questions can go to the contact form or to support@webtracknext.com.