onfus

Privacy policy

Last updated October 10, 2026.

Onfus is a website analytics service. This page covers two groups of people: visitors to websites that use Onfus, and customers who have an Onfus account.

Visitors to websites using Onfus

The Onfus script does not use cookies, localStorage identifiers or any other persistent storage on your device, and does not track you across sites. For each page view or custom event we record:

  • Page URL and referrer (query strings are dropped except UTM tags)
  • Browser, operating system and device type, from the User-Agent
  • Screen width class (mobile, tablet, desktop)
  • Country, region and city derived from the IP address
  • Event name and any custom properties the site owner chose to send

The IP address and User-Agent are combined with a secret that rotates daily into a one-way hash used to count unique visitors within a single day. The raw IP address is never stored. The hash cannot be reversed and changes every day, so visitors cannot be followed over time.

Because no personal data is stored and no identifiers persist on the device, sites using Onfus generally do not need a cookie banner for it. Site owners remain responsible for their own compliance.

Onfus customers

When you create an account we store:

  • Email address, and name and avatar if you sign in with Google
  • The websites you add and their analytics data
  • Workspace members and invitations you create
  • Billing details, handled by Stripe. We store a Stripe customer id and subscription status, never card numbers.

We use this data to run the service, email you about your account (sign-in codes, trial and billing notices, optional reports) and provide support. We do not sell data or use it for advertising.

Retention

Analytics data is kept for three years, or less if you set a shorter retention period per site. When a trial or subscription ends we keep your data for 30 days so you can come back, then delete it. You can delete a site, or your whole account, at any time; deletion is permanent.

Sub-processors

  • Vercel (hosting, USA/EU)
  • Supabase (database and authentication, USA)
  • Stripe (payments)
  • Resend (transactional email)
  • Google (optional sign-in)

Your rights

You can access, correct, export or delete your account data by emailing privacy@onfus.com. Visitors to sites using Onfus should contact the site owner, since we hold no data that identifies them.

Changes

We will post any changes here and update the date above. Material changes will be announced by email to account holders.