Privacy policy

Last updated: November 5, 2026

Realific is privacy-first web analytics. This policy explains what we collect when you use realific.app and our API (our “customers”), and what we process on our customers’ behalf about the people who visit their websites (“visitors”).

Realific (“we”, “us”) is responsible for the data described in sections 1 to 4. For visitor analytics (section 5) our customer is the controller and we act as their processor. Questions: privacy@realific.app.

1. Information we collect about customers

Account details: your name, email address and, if you sign in with Google or GitHub, your profile picture and the account identifier that provider gives us.
Workspace data: organisation and workspace names, team members you invite, websites you add, and their settings.
Billing data: your plan, tier and invoices. Card details are collected by Polar, our merchant of record, never by us.
Connected services: if you connect Stripe, Lemon Squeezy, Paddle, Polar, Shopify or Google Search Console, the access token or webhook secret needed to read your data. These are encrypted with AES-256-GCM before storage.
Security and session data: a hashed session token, a hash of the IP address used to sign in, and your browser’s user-agent string.
Support messages you send us.

2. How we use customer information

To provide the service: sign you in, show your dashboards, send reports and alerts you configure, and attribute revenue to traffic sources.
To bill you and enforce plan limits.
To keep the service secure, prevent abuse and debug problems.
To send service emails such as sign-in links, invitations and billing notices. We do not send marketing email without your consent.

We do not sell personal data, and we do not use it for advertising.

3. Signing in with Google, and Google user data

If you choose “Sign in with Google”, we request the openid, email and profile scopes. We receive your name, email address, profile picture and Google account ID, and use them only to create your account and sign you in.

If you connect Google Search Console to a website, we request read-only access (webmasters.readonly) and a refresh token. We use it only to show that site’s search keywords, clicks, impressions and positions inside your Realific dashboard. We do not read any other Google data, and you can disconnect at any time in Site settings → Integrations, or revoke access at myaccount.google.com/permissions.

Realific’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not let humans read it except with your consent, for security, or where the law requires, and do not use it to train AI models.

4. Cookies on realific.app

We use only cookies that are needed for the service to work:

rf_session: keeps you signed in (HttpOnly, 30 days).
rf_csrf: protects your account against cross-site request forgery (30 days).
rf_share_*: remembers that you unlocked a password-protected share link (7 days).

We do not use advertising or third-party tracking cookies. Our marketing site is measured with Realific itself, in cookieless mode.

5. Analytics data about our customers’ visitors

When a website uses the Realific script, we process the following on that website owner’s behalf:

Page views and events: page address, referrer, UTM campaign tags, screen width, browser language, and custom event names and properties the site sends.
Derived, coarse data: country, region and city from the request’s network location; browser, operating system and device type from the user-agent; whether the visit looks automated.
IP addresses are never stored. They are used in memory only, to derive location, to rate-limit abuse and, in cookieless mode, as one input to a daily-rotating salted hash. The salt is deleted after 48 hours, so visitors cannot be linked across days.
In cookie mode the script sets two first-party cookies on the customer’s own domain: _rf_vid (a random visitor ID, 1 year) and _rf_sid (a session ID, 30 minutes). In cookieless mode it sets none.
If a website calls identify(), the user ID it passes is stored; any email address is hashed with SHA-256 and a secret per-organisation key before storage, and the plain address is discarded.
If a website connects a payment provider, we store payment amount, currency, type (new, renewal, refund) and a hashed customer email, so revenue can be attributed to traffic sources.

Visitors should contact the website they visited to exercise their rights; we will help that customer respond. Realific respects Do Not Track and Global Privacy Control when the website owner enables that setting.

6. Sharing and sub-processors

We share data only with the service providers below, under contracts that limit their use of it to providing services to us, or when the law requires it.

Cloudflare, Inc.: Hosting, edge compute, databases (D1), object storage (R2), queues, DDoS and abuse protection.
Polar Software, Inc.: Merchant of record for Realific plans: checkout, subscriptions, invoices and sales tax.
Stripe, Inc.: Read-only Stripe Connect when a customer connects their own Stripe account; payment processing for Polar.
Resend, Inc.: Transactional email: sign-in links, invitations, reports and alerts.
Google LLC: Google sign-in, and Google Search Console data when a customer connects it.
GitHub, Inc.: GitHub sign-in.

The dashboard shows website icons for traffic sources. Icons for sites we do not bundle are loaded from DuckDuckGo’s icon service, which receives the site’s hostname only.

7. Retention

Raw analytics events: 13 months. Aggregated statistics: for your plan’s retention period (3 years on Starter, 5 years on Growth).
Account data: while your account is open. When you delete an organisation it is removed from the product at once and permanently deleted, including its analytics databases and exports, after 30 days.
Data exports: download links expire after 24 hours.
Billing records: as long as tax law requires.

8. Security

Data is encrypted in transit (TLS) and at rest. Each website’s analytics live in their own database, so one customer’s queries cannot reach another’s data. Passwords are hashed with PBKDF2-SHA256, API keys and session tokens are stored only as hashes, and provider secrets are encrypted with AES-256-GCM.

9. International transfers

We and our sub-processors operate in the United States and on Cloudflare’s global network. Where data about people in the EEA, UK or Switzerland is transferred, we rely on the European Commission’s Standard Contractual Clauses or an equivalent safeguard. EU data residency is available on request.

10. Your rights

You can access, correct, export or delete your personal data, and object to or restrict its processing. Most of this is available in your account settings; otherwise email privacy@realific.app and we will respond within 30 days. You may also complain to your local data protection authority. California residents have the right to know, delete and correct, and we do not sell or share personal information as those terms are defined in the CCPA.

11. Children

Realific is a business service and is not directed at children under 16. We do not knowingly collect their personal data.

12. Changes

We will post changes on this page and update the date above. If a change is significant, we will email account owners before it takes effect.