Privacy Policy

Effective August 13, 2026. Spooly is operated by Salt Rank LLC, 7280 NW 87th Terrace, Suite C210, Kansas City, MO 64153. Questions: contact@saltrank.com.

The two kinds of people this covers

If you hold a Spooly account, we are the controller of your account data. If you visited a website that uses Spooly, that site's owner is the controller and we process visitor data on their behalf. Most of this policy is about the second case, because that is where almost all the data is.

What the tracker collects on our customers' sites

• Pages viewed, clicks (including their position), scroll depth, and active time on the page.
• Signals derived from behaviour: repeated clicks, clicks that had no effect, form fields that were focused and for how long, text selection and copying classified by kind (a phone number, a price), printing, tab switches, and zooming.
• How the visit arrived: referrer, campaign parameters, and QR code scans.
• Device basics: browser, operating system, screen size, language, timezone, and city-level location derived from IP address.
• A random visitor identifier stored in the browser, scoped to the one site. It does not follow anyone across the web.

What it deliberately does not collect

• No screen or session recordings. There is no video of anyone, ever.
• No form values. Spooly records that a field was used and for how long, never what was typed into it. Fields whose names suggest passwords or card numbers are excluded from even that.
• No copied or selected text. The text is classified in the visitor's browser ("a phone number") and discarded; the content itself is never transmitted.
• No raw IP addresses at rest. IPs are hashed with a rotatable salt before storage, and site owners can additionally truncate them before hashing.
• No cross-site profiles, no data sales, no advertising use. Visitor data exists to show the site's owner how their own site is used, and for nothing else.

Retention

Detailed event data is deleted after 90 days. Aggregated statistics (counts, totals, heat grids) are kept so long-term trends survive. Whole visit records are deleted after roughly 13 months. When a customer deletes a site, everything it recorded is deleted immediately.

Account data

For account holders we store your email address, sign-in sessions, and billing status. Sign-in is by emailed link; we never store a password. Payments are processed by Stripe, and your card number never touches our servers. The dashboard sets one cookie, for your own sign-in, and none on tracked sites.

Who processes data for us

Vercel (hosting), Neon (database), Resend (email delivery), and Stripe (payments). Each receives only what its function requires.

Your rights

Email contact@saltrank.com to access or delete your account data. If you are a visitor to a customer's site, contact that site's owner, and we will support them in fulfilling your request, including deletion.

Changes

If this policy changes materially, account holders get an email before the change takes effect.