Analytics Transparency

Last updated: October 7, 2026

Almost every hosting company promises they respect your privacy. Very few tell you what their analytics actually do. This page tells you, for candordeploy.com.

Short version

We run analytics on hardware we own. There is no Google Analytics here, no advertising pixel, no tag manager. You can check that in about ten seconds: open your browser’s dev tools, go to the Network tab, and reload this page. Apart from the site itself, you’ll see requests to analytics.candorhost.com (our analytics server) and chat.candorhost.app (our chat widget, served by the same Candor Deploy API that runs the platform). Both are ours.

Two things collect data about your visit, and the rest of this page describes each one exactly: a cookie-free pageview counter called Umami, and a session recorder that captures how you navigate a sample of visits but never what you type.

One more party is involved, and we’d rather say so than leave it out: Cloudflare. Visits to candordeploy.com — the address without www — pass through Cloudflare’s network, which handles the secure connection and protects the site from attacks. That means Cloudflare sees each request to that address, including your IP address, the same way any network carrying your traffic does. Cloudflare is listed on our subprocessors page. Visits to www.candordeploy.com come straight to our own servers.

Server logs: we don’t keep per-request ones

Many sites keep a log line for every request, with your IP address in it. For candordeploy.com, today, we don’t: neither the web server that serves this site nor the router in front of it writes an access log. If that changes, this section will say so first.

What Cloudflare records about requests that pass through its network is governed by its own policies, linked from our subprocessors page.

Umami, for pageview counts and referrers

We run Umami, an open-source, cookie-free web analytics platform, on our own server at analytics.candorhost.com. When you load a page here, a small JavaScript file reports a single pageview event to it.

You can read exactly what Umami collects — the actual source, not a marketing claim — at github.com/umami-software/umami.

What it sees:

• The URL of the page you visited.
• The referring URL you came from.
• Your screen size.
• Your browser and OS.
• Your approximate country, derived from your IP address.
• The time of the visit.
• Any UTM parameters in the URL, so we can tell which of our own social posts, emails, or campaigns worked.

What it does not see:

• No cookies of any kind.
• No cross-site tracking. Umami has no ability to link a visit here to your activity on any other site.
• No fingerprinting.
• Your IP address is never stored. Umami uses it, along with your user agent, as an input to a one-way hash that groups the pages of a single visit together. The hash cannot be turned back into an IP address, and we never see one.

One honest caveat about the word “anonymous.” That hash means the pages you view in a single visit are linked to each other. It is not a per-pageview blank slate, and we’re not going to claim it is. What it is not is an identifier that persists across visits, follows you to other sites, or tells us who you are.

How long we keep it: 12 months, rolling. Older pageview data is deleted automatically, every night. Umami’s default is to keep data forever; we’ve chosen not to.

Where the data lives: on our own server, in a database we run. It does not leave our infrastructure, it is not sold, and it is not shared with any third party. Only Candor staff can access the dashboard.

We are not going to use ad-blocker evasion. Umami can be configured to rename its script and endpoint to slip past blocklists. We’ve deliberately left the defaults in place. If you’ve installed a blocker, it will block us, and we’ll simply have less data. That seems like the correct outcome.

Campaign links: one value in your browser, for this tab only

If you arrive from one of our posts or campaigns, the link carries utm_ parameters. We keep those in your browser’s sessionStorage, under the name ch_attr, and add them to the link if you go on to sign up at deploy.candorhost.com or to our billing portal. If you do create an account, we record that campaign on it — once, when the account is created. That’s how we tell which campaigns bring us customers rather than just clicks.

It’s not a cookie and not localStorage. It belongs to that one browser tab, and your browser discards it when you close the tab. It can’t follow you between visits or to another site. Our cookie policy has the details.

Three conversion counts, sent by our own servers

To know which campaigns lead to real customers, the Candor Deploy platform itself — not your browser — reports three milestones to the same Umami server:

• an account was created (after its email address was confirmed),
• an organization’s first app went live, and
• a payment was collected — with its amount, and whether it was that organization’s first. Free credit, trials and card checks are never reported as payments.

Each report carries an event name, a random ID that stands for the account or organization, the campaign the account signed up from (the utm_ values above, if there were any), and a random ID for the event itself. It never carries your name, your email address, your account or billing IDs, or anything about your card. The random IDs are generated by us and mean nothing outside our own database. The dashboard at deploy.candorhost.com still loads no analytics or recording code; these reports go server to server.

Accounts belonging to Candor staff, and test, demo and review accounts, are left out.

Session replay and heatmaps, on our own servers

This is the part most companies don’t tell you about, so we’re going to be exact.

On a sample of visits — about 15% — we record how visitors move through the site: mouse movement, scrolling, clicks, and the order pages were visited in. We use it for two things: finding where the site is broken, and learning which parts of a page people actually read. It runs on the same server as the rest of our analytics, using Umami’s built-in recorder.

What is not recorded: anything you type.

Every text field on the site is masked in recordings. The contact form — this site’s only form — goes further: it is excluded from recording at the element level. Not masked, not starred out: excluded, so there is nothing stored to reveal.

We didn’t take the setting’s word for it. On September 30, 2026 we filled in our own contact form with marked test values on a recorded visit, then searched everything the recorder sent. The page’s own words were in there — which is how we know the recording was working at all — and not one character of what we had typed. We’d rather verify a privacy claim than publish one and hope.

Where it never runs: the Candor Deploy dashboard at deploy.candorhost.com. Your account, projects, and billing are managed there, and it carries no analytics or recording code.

Where the data goes: nowhere. Recordings are written to a database on a server we own, and they are never sent to a third party, never sold, and never used for advertising.

How long we keep it: 30 days, then deleted automatically. That’s much shorter than the 12 months we keep pageview counts, because a recording is a far more detailed thing to hold onto.

Our line is this: recording how someone navigates a page so we can fix what’s broken is reasonable. Recording what they type is not. If you think we’ve drawn that line in the wrong place, tell us — [email protected].

What we do not use

• Google Analytics. Uses cookies, tracks visitors across sites, requires a cookie banner in most jurisdictions. Blocked by our privacy policy.
• Facebook Pixel, X Pixel, LinkedIn Insight Tag. Retargeting infrastructure. We don’t run retargeted ads and we have no reason to install them. Our campaigns link here with plain UTM parameters, and that’s all we learn from them.
• Hotjar, FullStory, Mouseflow, or any third-party session recording service. The objection is not recording as such — we do record navigation, as described above. The objection is shipping it to someone else. These services send your behaviour to a company you have no relationship with, on infrastructure you can’t inspect. Ours stays on our own hardware.
• Any third-party heat-mapping, A/B testing, or personalization tool that requires cookies or persistent identifiers.

Do Not Track and Global Privacy Control

On this site, we do not track visitors across third-party sites, so DNT and GPC signals do not change the pageview counts we collect. We follow the same practices for every visitor.

They do change one thing: if your browser sends either signal when you sign in to Candor Deploy, we record that on your account and never send any of the three conversion reports above for you or for organizations you create. Your account still counts in our own records — we need those to run the business — but nothing about it reaches our analytics.

How to check our work

Open your browser’s dev tools, go to the Network tab, and reload this page. You should see:

• A request to analytics.candorhost.com/script.js — the pageview tracker.
• A request to analytics.candorhost.com/api/send — your pageview. Click it and read the payload; it shows exactly what we recorded, and it matches the list above.
• A request to analytics.candorhost.com/recorder.js. If your visit is one of the sampled ones, you’ll also see one or more requests to /api/record — the session recorder.
• A request to chat.candorhost.app/v1/support/widget.js — the chat widget in the corner, loaded from our own API. It talks to that API only once you open it and start a conversation.

Then check the Application tab: no cookies from us, and under Session Storage, ch_attr only if you arrived from a campaign link. If you’ve started a chat, Local Storage holds candor.support.session.v1 — the token that lets you pick that conversation back up after a reload. It reaches only that one conversation, and clearing it simply starts a fresh one next time. On candordeploy.com without www, Cloudflare’s security features can set a short-lived cookie of their own (named __cf_bm) if they suspect automated traffic; ordinary visits normally don’t get one.

If you want to test the form claim yourself, type something into our contact form on a sampled visit, then watch what /api/record sends. What you typed will not be in it.

We think you should be able to do this on any hosting company’s website. Not many make it easy.

Contact

Questions about what we track? Email [email protected].