Analytics Transparency — Candor Deploy

Last updated: July 28, 2026

Almost every hosting company promises they respect your privacy. Very few tell you what their analytics actually do. This page tells you.

Short version

We run analytics on hardware we own, and no third party receives any of it. There is no Google Analytics here, no advertising pixel, no tag manager. You can check that in about ten seconds: open your browser’s dev tools, go to the Network tab, and reload this page. Every request you see goes to candorhost.com or analytics.candorhost.com — both ours.

Three things collect data about your visit, and the rest of this page describes each one exactly: our server’s access log, a cookie-free pageview counter called Umami, and a session recorder that captures how you navigate but never what you type.

What runs today: server access logs

Every web server writes a line to a log file for every request it receives. This is standard practice going back to the 1990s and is how you tell whether your website is working. Our server writes these logs to disk in Vint Hill, Virginia. They stay there.

What a log line contains:

The URL you requested.
Your IP address.
The referring URL, if your browser sent one — many now strip this by default.
Your user agent string (browser, OS).
The HTTP status code we returned (200 OK, 404 not found, etc.).
The size of the response in bytes.
The time of the request.

Being precise about the IP address: the log records it in full. We’re not going to tell you it’s anonymized, because at the log level it isn’t. This is how essentially every web server on the internet works, and it’s what lets us investigate abuse reports, block attacks, and tell a real visitor from a bot. It is not used to build a profile of you, it is not combined with anything else, and it is not shared with anyone.

What the logs do not contain:

No cookies. No JavaScript runs in your browser for this.
No fingerprinting.
No form field content.
No account information.

How long we keep them: see Section 10 of our Privacy Policy, which is the single source of truth for our retention periods.

Umami, for pageview counts and referrers

We run Umami, an open-source, cookie-free web analytics platform, on our own server at analytics.candorhost.com. When you load a page here, a small JavaScript file reports a single pageview event to it.

You can read exactly what Umami collects — the actual source, not a marketing claim — at github.com/umami-software/umami.

What it sees:

The URL of the page you visited.
The referring URL you came from.
Your screen size.
Your browser and OS.
Your approximate country, derived from your IP address.
The time of the visit.
Any UTM parameters in the URL, so we can tell which of our own social posts, emails, or ad campaigns worked.

What it does not see:

No cookies of any kind.
No cross-site tracking. Umami has no ability to link a visit here to your activity on any other site.
No fingerprinting.
Your IP address is never stored. Umami uses it, along with your user agent, as an input to a one-way hash that groups the pages of a single visit together. The hash cannot be turned back into an IP address, and we never see one.

One honest caveat about the word “anonymous.” That hash means the pages you view in a single visit are linked to each other. It is not a per-pageview blank slate, and we’re not going to claim it is. What it is not is an identifier that persists across visits, follows you to other sites, or tells us who you are.

How long we keep it: 12 months, rolling. Older pageview data is deleted automatically. Umami’s default is to keep data forever; we’ve chosen not to.

Where the data lives: on our own server, in a database we run. It does not leave our infrastructure, it is not sold, and it is not shared with any third party. Only Candor Host staff can access the dashboard.

We are not going to use ad-blocker evasion. Umami can be configured to rename its script and endpoint to slip past blocklists. We’ve deliberately left the defaults in place. If you’ve installed a blocker, it will block us, and we’ll simply have less data. That seems like the correct outcome.

Session replay and heatmaps, on our own servers

This is the part most companies don’t tell you about, so we’re going to be exact.

On our marketing pages we record how visitors move through the site: mouse movement, scrolling, clicks, and the order pages were visited in. We use it for two things — finding where the site is broken, and learning which parts of a page people actually read. It runs on the same server as the rest of our analytics, using Umami’s built-in recorder.

What is not recorded: anything you type.

Every form on this site — the domain search on the home page, the beta signup on the Deploy page, and the contact form — is excluded from recording at the element level. Not masked, not starred out: excluded, so there is nothing stored to reveal.

We didn’t take the setting’s word for it. We filled in our own contact form with marked test values, then decompressed the recording straight out of the database and searched it. The page’s own words were in there — which is how we know the recording was working at all — and not one character of what we had typed. We’d rather verify a privacy claim than publish one and hope.

Where it never runs: the billing portal at my.candorhost.com. Your account, invoices, and payment details are on a different system entirely, and it carries no recording code.

Where the data goes: nowhere. Recordings are written to a database on a server we own, and they are never sent to a third party, never sold, and never used for advertising.

How long we keep it: 30 days, then deleted automatically. That’s much shorter than the 12 months we keep pageview counts, because a recording is a far more detailed thing to hold onto.

Our line is this: recording how someone navigates a page so we can fix what’s broken is reasonable. Recording what they type is not. If you think we’ve drawn that line in the wrong place, tell us — legal@candorhost.com.

What we do not use

Google Analytics. Uses cookies, tracks visitors across sites, requires a cookie banner in most jurisdictions. Blocked by our privacy policy.
Facebook Pixel, Twitter Pixel, LinkedIn Insight Tag. Retargeting infrastructure. We don’t run retargeted ads and we have no reason to install them.
Hotjar, FullStory, Mouseflow, or any third-party session recording service. The objection is not recording as such — we do record navigation, as described above. The objection is shipping it to someone else. These services send your behaviour to a company you have no relationship with, on infrastructure you can’t inspect. Ours stays on our own hardware.
Any third-party heat-mapping, A/B testing, or personalization tool that requires cookies or persistent identifiers.

Do Not Track and Global Privacy Control

Because we do not track visitors across third-party sites, DNT and GPC signals do not change what we collect. We follow the same practices for every visitor.

How to check our work

Open your browser’s dev tools, go to the Network tab, and reload this page. You should see:

A request to analytics.candorhost.com/script.js — the pageview tracker.
A request to analytics.candorhost.com/api/send — your pageview. Click it and read the payload; it shows exactly what we recorded, and it matches the list above.
A request to analytics.candorhost.com/recorder.js, and one or more to /api/record — the session recorder.

Then check the Application tab: no cookies from us.

If you want to test the form claim yourself, type something into our contact form, then watch what /api/record sends. What you typed will not be in it.

We think you should be able to do this on any hosting company’s website. Not many make it easy.

Contact

Questions about what we track? Email legal@candorhost.com.