Privacy Policy

OceanWave Analytics is a privacy-first, cookieless web analytics product operated by ("we", "us"). This Privacy Policy explains what data we handle when you visit our website, use the OceanWave Analytics dashboard, or when our tracking script runs on a website operated by one of our customers.

We built OceanWave Analytics so you can measure your website without surveilling your visitors. By design:

• We do not use tracking cookies, and no cookie consent banner is required.
• We do not collect or store personal data such as names, emails, or precise locations from your visitors.
• We do not fingerprint devices and we do not track people across different websites.
• Metrics are aggregated and anonymous.

Visitor analytics (on customer websites): when our script runs, we process anonymous, aggregated signals such as page URL, referrer, country (derived transiently from IP, which is never stored), device type, browser, screen size, and anonymised performance metrics (Core Web Vitals). Customers may also send custom events and revenue events they choose to configure.

Account data (when you sign up for OceanWave Analytics): your email address and authentication details, workspace settings, and basic billing information needed to manage your subscription.

Payment data: handled by our payment processor (Polar). We never see or store full card numbers.

We use the data above to provide the analytics service, secure and operate our infrastructure, communicate with you about your account, process payments, and improve the product. We do not sell your data or your visitors’ data, and we do not use it for advertising.

Our analytics does not set cookies on your visitors’ devices. The OceanWave Analytics dashboard uses a small number of strictly necessary cookies/local storage entries solely to keep you signed in and remember your preferences.

Aggregated analytics are retained for as long as your account is active so you can see historical trends. Account data is kept while your account exists and for a short period afterwards as required for legal and accounting purposes. You can request deletion at any time.

We rely on a small set of trusted providers to run the service: Supabase (database, authentication and email delivery), Polar (billing and payment processing), and Vercel (website and application hosting). Each is bound by contractual data-protection obligations. A current list is available on request.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, email us and we will respond within the timeframe required by law.

We protect data in transit and at rest using industry-standard encryption, apply least-privilege access controls, and review our security practices regularly. No system is perfectly secure, but we work hard to keep your data safe.

We may process data on infrastructure located in different countries. Where data is transferred internationally, we rely on appropriate safeguards such as Standard Contractual Clauses.

OceanWave Analytics is not directed to children under 18, and we do not knowingly collect personal data from them.

We may update this policy from time to time. We will revise the “Last updated” date above and, for material changes, notify account holders by email.