Privacy policy

When you sign up we keep your name, email address and a hashed password. If you pay, Stripe handles the card; we keep only the subscription and invoice records Stripe sends us.

We email you about your account: sign-in links, alerts and reports you set up, and billing notices. You can turn reports and alerts off in settings.

The site owner decides to use Pathrail and is responsible for telling their visitors. For each page view we record the page, the referring site, campaign tags, an approximate location (country, region and city, worked out from the IP address), browser, operating system, device type, screen size, language, and how long the page was open.

We never store the IP address. We keep a one-way hash of it, used to filter bots and the site owner's own visits. A visitor is recognised across visits by a random id in a first-party cookie, or, where the site turns cookies off, by a hash that changes every day.

If the site tells Pathrail who a visitor is (for example after they sign up), we store a one-way hash of their email address, not the address itself, so their payments can be matched to the visit that led to them. Payment records come from the site's own Stripe account.

A customer can connect their Google account to bring in their own Search Console, Google Analytics and Google Ads data. We ask only for read access (Google Ads needs its standard scope to read reports), and use it only to show that customer their own search queries, traffic and ad spend inside Pathrail. We keep the refresh token encrypted and can be disconnected at any time from settings or from your Google account.

Pathrail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't sell this data, use it for advertising, or use it to train AI models, and no person at Pathrail reads it unless you ask us to for support or the law requires it.

Only the services that run Pathrail: DigitalOcean (hosting, in North America), Stripe (payments), and our email provider (account emails). We don't sell personal data or share it for advertising.

Analytics data stays while the site is on Pathrail. When a customer deletes a site, all of its data is deleted; when they ask us to close their account, we delete the account too. Account emails and billing records are kept as long as the law requires.

Customers can export their data as CSV and delete a site with all its data from settings. Visitors who want their data removed from a site should ask that site's owner, who can delete it in Pathrail; you can also write to us at contact@pathrail.io and we'll pass it on or act on it.

If we change this policy we'll update the date above, and email customers about anything that matters.