Privacy policy
Last updated 6 August 2026
Dupes Analytics(“dupes”, “we”) builds web analytics for people who don’t want to run surveillance on their visitors. This policy covers two different groups, and the distinction matters: our customers, who have an account with us, and visitors to our customers’ websites, who do not.
1. Visitors to a website that uses dupes
If you landed here because you saw dupes mentioned on a site you were browsing, this section is the one that applies to you.
We do not build a profile of you. We do not track you across different websites, we do not sell or share data with advertisers or data brokers, and we do not attempt to identify you personally.
What is recorded
- The page URL and its path, without query strings.
- The referring URL, and campaign tags (utm_*) if the link carried them.
- Ad click identifiers (gclid, fbclid, msclkid) when present in the link, used only to classify the visit as paid traffic.
- Approximate location — country, region and city — derived from the network request.
- Browser, operating system and device type, derived from the user-agent.
- Screen size, language and timezone.
- Named events the site owner chose to measure, such as a form submission or a purchase, plus any properties they attach to them.
What is not recorded
- Your IP address. It is used in-memory to derive the pseudonymous identifier below and to look up your country, then discarded when the request ends. It is never written to our database.
- Your name, email address, or any other direct identifier — unless a site owner deliberately attaches one as an event property, which is their choice and their responsibility under section 3.
- Keystrokes, mouse movement, scroll recordings, session replays, or the contents of any form.
- Anything at all about your activity on other websites.
How a returning visit is recognised
Each site chooses one of two modes, and the site owner can tell you which they use.
- Cookieless — nothing is stored on your device. A visitor identifier is derived server-side by hashing your IP address, user-agent and the site id together with a secret salt that rotates on a fixed cycle. The hash cannot be reversed to recover your IP, and once the salt rotates the old identifier can no longer be linked to a new one.
- First-party cookie — a single cookie set on the site's own domain, holding a random identifier and nothing else. It is never readable by any other website.
In both modes the identifier is scoped to a single website. The same person visiting two different dupes-tracked sites produces two unrelated identifiers, by design.
Automated traffic
We identify visits from search-engine and AI crawlers (for example GPTBot, ChatGPT-User, Googlebot) from the user-agent, and where possible confirm them against the operator’s published IP ranges. These are recorded and reported separately, and are excluded from a customer’s billable event count.
2. Our own customers
If you have a dupes account, we hold your email address, any display name you set, your theme and notification preferences, the websites you have added, and your subscription state.
Payments are handled entirely by Stripe. Card details are submitted directly to Stripe and never reach our servers; we store only the Stripe customer and subscription identifiers, the plan, and the renewal date.
Sign-in is by a one-time code emailed to you. We do not store passwords because there are none.
Retention
Analytics events are retained for the period included in your plan — 3 years on Pro, 5 years on Max. Deleting a website deletes every event recorded for it immediately and irreversibly. Deleting your account removes everything.
3. Who is responsible for what
For visitor data, our customers are the data controller and dupes is the processor: they decide what to measure, we measure it on their behalf and do nothing else with it. A customer who chooses to attach personal data to an event — an email address as a goal property, say — is responsible for having a lawful basis to do so.
For customer account data, dupes is the controller.
4. Sub-processors
- Supabase — database and authentication hosting.
- Vercel — application hosting and content delivery.
- Stripe — payment processing and subscription billing.
- Microsoft Clarity — heatmaps and session replay, on our marketing pages only.
5. Cookies on this website
usedupes.com itself sets a session cookie once you sign in, and a cookie remembering your light or dark theme preference. Both are strictly functional.
We also run dupes on our own marketing pages — the same product described in section 1, on the same terms — and, on those pages only, two third-party tools. The Meta pixel, so that we can measure which of our advertising actually works: you can opt out of Meta’s advertising cookies through your Facebook ad settings. And Microsoft Clarity, which records how visitors move through those pages — clicks, scrolling and mouse movement — so we can see where the site confuses people: Microsoft’s handling of that data is covered by its privacy statement. Neither runs inside the signed-in application.
6. Your rights
If you are in the UK, EU or another jurisdiction with equivalent law, you have the right to access, correct, export or erase your personal data, and to object to its processing.
If you have an account: Settings → Account contains a delete button that removes your account, every website on it and every event ever recorded for them. It takes effect immediately and cannot be undone.
If you are a visitor to a customer’s site: because we hold no identifier that can be traced back to you, we genuinely cannot locate “your” data to export or delete it — there is no key to look it up by. That is a deliberate consequence of the design rather than an evasion. Contact the website operator directly, and they can delete their entire dataset.
7. Changes
If we change this policy materially we will update the date at the top and email account holders before it takes effect.