What we collect. What we never collect.
Citealytics is cookieless by design. There is nothing to consent to, because we never store anything that can identify a person. Your data stays in the region you pick — EU or US.
What we collect
- Page path (e.g. /pricing)
- Referrer domain
- User agent string (server-side, for AI-bot classification)
- Country, derived from IP at request time — the IP is never stored
- Device type and browser family
- Screen size bucket
- Timestamp of the request
What we never collect
- Analytics cookies of any kind — first or third party
- Personal data or anything that identifies a visitor
- IP addresses in storage or logs
- Cross-site or cross-device profiles
- Fingerprints built from canvas, fonts or audio
- Data sold or shared with ad networks
Do we use cookies?
Citealytics sets no analytics cookies, ever — not on your site, not on ours. The one cookie you may observe is __cf_bm, set by Cloudflare, our edge and bot-protection provider. It is HttpOnly, expires after 30 minutes, exists purely to distinguish bots from humans at the network layer, and is never read by Citealytics or used for analytics, advertising or profiling. Under the ePrivacy Directive it qualifies as strictly necessary, which is why no consent banner is required.
How AI attribution works
Each request is matched against a curated registry of AI-crawler signatures: user-agent tokens (GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot, Google-Extended and more), regular expressions, and published IP ranges. Matching happens server-side on data we already receive — no extra tracking is required. Requests that send DNT: 1 are dropped before anything is written.
Data retention
Raw events are retained according to your plan — 30 days on Free, 12 months on Starter, unlimited on Growth and Agency. Daily aggregates are kept for the lifetime of the account. You can export or permanently delete all of your data from Settings at any time; deletion is immediate and irreversible.
Subprocessors
| Provider | Purpose | Region |
|---|---|---|
| Cloudflare | Edge delivery, DDoS and bot protection | Global edge |
| Supabase | Database and authentication | EU or US, your choice |
| Stripe | Payments and invoicing for paid plans | US / EU |