Privacy · no jargon, no dark patterns
This site counts visits. Not people.
There is no third-party tracker on these pages, no advertising pixel, no cookie banner and nothing sold or shared. What follows is the complete list of what is measured, what is refused, and how to have your own rows removed.
Counted, and never stored.
Counted, per visit
- The path of the page you opened, for example /library.html — the path only, never a query string.
- A two-letter country code, read from the Vercel edge header on your request. Not your city, network or coordinates.
- The hostname that referred you here, for example news.ycombinator.com — the host, never the whole URL.
- That you did something worth knowing about: opened a preview, copied a snippet, searched the library, switched theme, clicked through to GitHub, or joined the waitlist.
- The short id of the thing you touched, so the owner can see which component is useful. A search is counted as one search; the words you typed are dropped before anything is written.
Refused outright
- Your IP address. It reaches the server as part of any web request and is never written down.
- Your user agent string. It is read only to discard obvious bots, then thrown away.
- Query strings and URL fragments, so a search term cannot arrive by the back door.
- Your name, email or anything you type into a field — except the waitlist address you deliberately submit.
- The contents of a code snippet you copy, and every other piece of page text.
- Session replay, screenshots, heatmaps, fingerprinting, cookies and cross-site identifiers.
The rules are enforced twice: the collector in site/assets/analytics.js only ever sends the fields above, and /api/track re-validates every value server-side and rejects anything else before a row is written. The database columns themselves have no place for an IP, a user agent or free text.
The anonymous id in your browser
One value is kept in localStorage under the key mue-vid: sixteen random characters, generated once by your browser. It is what lets the owner tell “50 visits” apart from “50 different people”, and it is why returning visitors can be counted without an account or a cookie.
It is not derived from you in any way — not from your IP, screen, fonts or user agent. It does not survive a storage wipe and identifies nothing on its own. Clearing this site’s browser storage, or using a private window, resets it.
To remove it by hand: open this site’s developer tools, then Application → Local Storage, and delete mue-vid.
The waitlist
If you join the waitlist, two things are stored: your email address and the day you joined. It lives in the site’s own Supabase database, reachable only by the site’s server-side functions, and is used for one thing — telling you when something new ships.
- No mailing-list provider, no forwarding, no other party receives it.
- Repeated signups with the same address do not create extra rows, and a fast burst of attempts from one device is refused.
- Reply to any message to unsubscribe, or ask the maintainer to delete the row outright.
Getting your data gone
Self-service, ten seconds
Clear this site’s browser storage. That removes mue-vid, and every visit that only that id could link becomes unlinkable. Unsubscribe from any waitlist mail you received, and there is nothing left to match.
Ask for the rows themselves
Contact the maintainer through the GitHub repository. For an anonymous-visit deletion, include the mue-vid value still in your browser’s local storage — that string is the only handle the data is reachable through, which is also why it cannot be matched to you.
What deletion actually does
site/api/track.js writes visit rows and visitor membership rows; deleting your id removes both, plus your referrer and country tallies. DEPLOYMENT.md documents the exact SQL, and the owner can run it in minutes.
Who reads the data: the site owner, through the console at /admin, which sits behind a username, password and signed session cookie. It shows aggregates — counts, ranked pages, ranked countries — and, on demand, the individual rows, which the owner can erase one visitor at a time from that same screen.
Because the kit is open source
Every line that measures a visit is public: the collector is site/assets/analytics.js (about a hundred lines, one localStorage key, one POST /api/track), the endpoints are site/api/track.js, site/api/stats.js and site/api/subscribe.js, and the storage shape is supabase/schema.sql, which has CHECK constraints forbidding the columns this notice promises do not exist.
Read them, run them, or fork the repo and delete all of it — the site works identically without analytics, and every endpoint answers honestly when its database is not configured instead of inventing a number.
Last updated: 2026-11-01. This notice describes the product website only; it does not apply to software you build with the kit.