Private analytics by design

Every product wants to know how it's doing — how many people sign up, whether they come back, how they're subscribed. Most products answer that by embedding an analytics SDK that phones home with your device fingerprint, your IP, and a timeline of everything you click.

We think that's a bad trade. A privacy product shouldn't need to break your privacy to measure its own health. So we wrote down the rules we follow, and here they are, in full.

The rules

• No third-party trackers. No Google Analytics, no ad pixels, no analytics SDK. Page views are counted by Cloudflare Web Analytics, which is cookieless and doesn't fingerprint you.
• No cookies, no fingerprinting. We don't drop any persistent identifier on your device to stitch your visits together.
• IPs are not stored. We don't keep raw IP addresses in our own metrics.
• Only aggregates, never timelines. We store “how many on this day”, not “who did what, when”.
• Marketing analytics and account identity are fully separated. A page view never carries your user id or email.
• Analytics never store a raw user id. Daily active users are counted by hashing the user id with a secret key before it's stored — so even we can't read the list back to real accounts.
• Zero-knowledge by construction. Our servers only ever hold ciphertext and an SRP verifier. They are architecturally unable to read your notes, so there is no content to leak to any analytics system.
• Transparent and auditable. This page is the disclosure. If we ever change these rules, we'll update it here first.

What we actually measure

Growth (registrations), whether people come back (daily unique logins, hashed), and how many are on each plan (a cached tier count — Stripe is the source of truth for billing). That's it.

None of it can be tied back to an individual, and none of it touches what you write. That's the whole point of private analytics: you can have one without giving up the other.