What we collect, precisely
This describes what the software does, not what we would like you to believe it does. It is not legal advice, and it does not cover your own obligations for anything else running on your site.
Analytics on this website
getmayfly.com uses Mayfly to measure visits to its public pages, including the demo and the Mayfly House. Login, signup, account recovery, verification, admin and customer dashboard, shared-report and public-check routes are excluded from this website’s analytics. Referrers are reduced to their origin before transmission. The tracker honours the opt-out settings below.
Public website check
With your confirmation that you own or may check a website, Mayfly requests up to five public pages and their robots instructions. It does not execute that site’s scripts or save the report or HTML in its database. Results remain in the requesting browser tab; reloading clears them. Short-lived abuse counters use hashed network and hostname keys, rather than analytics visitor records. Hosting providers may keep request logs under their own policies. The public check does not collect an email address or run Mayfly’s website analytics.
Account setup evidence
Mayfly stores account and website setup records, including ownership verification, completed audits and Search Console connection status. The Postgres backend also records when a site first stores an event. These operational records help the operator identify setup problems; they do not create cross-day profiles of your website’s visitors. Existing sites are labelled as having incomplete event history.
Reviewing a finding
When you deliberately load a finding review, Mayfly prepares a bounded evidence snapshot and a receipt for your signed-in account. Opening a finding or marking it as reviewed records the corresponding timestamp. Simply visiting or prefetching a dashboard page does not record either action. Reviewed means acknowledged by that account, not fixed or resolved, and it does not change another member’s review status. Short-lived hashed account and site counters limit repeated report preparation; they do not identify your website’s visitors.
Saved review records contain account and site associations, opaque identifiers, evidence digests, coverage and reporting-window metadata, not copied page paths, search queries or visitor identities. Snapshots expire after 30 days and are capped at 180 per site; their receipts are deleted with them. First-recorded action milestones remain with the account/site relationship. Accepted finding actions also record a Monday-UTC week marker, retained for the current and four completed weeks. These markers measure finding interactions only, not all product use or returning website visitors. Expired records become unusable immediately and are physically removed by maintenance. Account and site exports include the associated records; hard erasure removes them.
Sharing a report
Reports are private by default. A verified site’s owner can explicitly publish a link showing its hostname, pageviews and daily unique counts for the last seven complete UTC days. Anyone with that link can view those totals and daily counts. The shared view excludes page paths, search queries, referrers, revenue and visitor or session identifiers. Revoking or replacing the link prevents subsequent reads; it cannot erase copies that someone has already saved. Mayfly does not run its website analytics on the shared view.
How a visitor is counted
There is no identifier stored on the visitor’s device. Instead, each event is attributed to a hash:
visitor_id = sha256( daily_salt + site_id + ip_address + user_agent )
The salt is random, rotates every day at UTC midnight, and the old value is deleted from the live database once it is two UTC dates old. With the documented 03:00 UTC daily schedule, the maximum live lifetime is about 51 hours. While a salt exists, the corresponding hashes could in principle be worked backwards to an IP address, because IPv4 has only about four billion possibilities. After it leaves the live system, the application can no longer perform that reconstruction. Database backups and write-ahead logs can retain a deleted salt until the infrastructure provider’s backup-retention period expires, so operators must configure that window as part of deployment. The live deletion runs as a scheduled job and the system exposes a metric so a stopped job is noticed.
The honest consequence: a visitor identifier lasts one day. We cannot tell you whether someone came back next week, and we do not offer a report that implies we can.
What is stored
| Field | Detail |
|---|---|
| Page URL | Query strings are stripped by default. Site owners can opt in specific parameters; common identifiers and credential-shaped values are redacted before storage. |
| Page title | As reported by the document, with email addresses and bearer-token shapes redacted. Titles are site-controlled content and must not contain personal data. |
| Referrer | Host only, resolved to a source name. Same-origin referrers are discarded as internal navigation. |
| UTM parameters | Only if present in the URL. |
| Country, region, city | Derived from the IP address at request time, then the address is discarded. |
| Browser, OS, device class | Parsed from the User-Agent header. |
| Screen size bucket | One of five breakpoint classes, not the exact dimensions. |
| Engaged time and scroll depth | Foregrounded milliseconds and furthest scroll percentage. |
| Core Web Vitals | LCP, INP, CLS, TTFB, FCP, as measured by the browser. |
| Custom event names and properties | Only what the site owner chooses to send. Common identity keys and email/token-shaped values are dropped, but site owners must not send personal data. |
| Search performance | If a customer connects Google Search Console, Mayfly imports aggregate query, page, country and device metrics for that customer's verified property. |
| Customer account data | Dashboard accounts use an email address, password hash, membership records and a strictly necessary session cookie. Search Console refresh tokens and queued transactional-email payloads are encrypted at rest. |
| Early-access waitlist | With your consent, Mayfly stores your email, optional website hostname, signup time and invitation-delivery status in Postgres. These are not analytics events and do not create an account. Only configured, verified operators can read this list or send invitations. |
What the tracker does not persist
- Analytics cookies or browser identifiers. The authenticated customer dashboard does use a strictly necessary session cookie.
- Raw IP addresses in the analytics event store. The collector uses an address transiently for country lookup, abuse control and daily visitor hashing, then discards it. Hosting and network providers may retain access logs under the operator's own policy.
- Names, email addresses, or account identifiers as intended analytics fields. Common accidental identifier keys and values are rejected, and customers are prohibited from sending personal data.
- Cross-site browsing history. The visitor hash includes the site id, so the same person on two customers’ sites produces two unrelated identifiers.
- Device fingerprints. No canvas, no audio, no font enumeration, no WebGL.
Customer responsibility
Mayfly is designed for aggregate website measurement, not user profiling. Do not place names, email addresses, account ids, reset links, free-form customer messages or other personal data in tracked URLs, page titles, event names or properties. Server-side guards remove common mistakes, but no heuristic can recognise every possible identifier.
Retention
Waitlist contacts are eligible for removal after 365 days by scheduled maintenance, once any retained invitation-delivery job is removed. Operators can remove a contact earlier on request. Waitlist emails are used only for early-access invitations. Events awaiting recovery after a collector storage failure may be kept in a bounded Postgres queue for up to 24 hours, then removed from that queue on delivery or expiry. Queue status metadata is kept for seven days. This invite-only Postgres beta retains events and crawl results for 30 days. Search Console imports retain 90 settled dates, allowing for Google’s reporting delay. Daily maintenance removes expired rows at its next run, so deletion can take up to one additional day. Reports do not promise history beyond their source’s retained window. The collector writes directly to Postgres and does not use the cross-store recovery queue. Queued email ciphertext is erased immediately after delivery, terminal failure or expiry; non-content delivery metadata is removed after seven days. Audit-change emails are optional for verified site owners and admins. A subscription stores the account and site association, consent time and a version used to invalidate old queued messages. Turn it off under Automatic audits. These emails contain aggregate change counts and a link to the authenticated report, not individual page URLs or visitor information. A daily salt remains in the live database for today and the previous UTC date, then is removed by the next scheduled maintenance run (about 51 hours maximum at the documented 03:00 UTC schedule).
Export and deletion
Operators can create a site-scoped export covering account configuration, raw events, aggregates, Search Console rows and crawl results. A separate hard-erasure command first disables collection, deletes the Google credential, removes and verifies every live analytics row, then deletes the site’s control-plane records. Infrastructure backups expire on the operator’s documented provider-retention schedule rather than instantly.
Opting out
The tracker honours the Do Not Track browser setting even though it is widely ignored elsewhere, and it never runs on localhost. Any visitor can exclude themselves permanently on a device by running:
localStorage.setItem('mayfly_ignore', '1')That flag is read locally and never transmitted.