TypeUI Insights Data Policy
A clear guide to the website data TypeUI Insights collects, leaves out, stores, and deletes.
Effective date: September 1, 2026
If you add TypeUI Insights to your website, this page explains what the tracker sends and how we handle it. Information about your TypeUI account, billing, and support requests is covered by the Privacy Policy.
What Insights helps you understand
Insights shows you how people find and use your website: traffic, campaigns, page journeys, engagement, conversions, clicks, scrolling, frustration signals, and heatmaps. You choose which websites use Insights and why. This normally makes you the controller or business, while Bergside processes the analytics data to provide the service. Our Data Processing Addendum explains these roles.
What the tracker collects
| What you see | What we use to provide it |
|---|---|
| Pages | Your registered website, page path, internal page and site identifiers, and timestamps so activity appears on the correct page in your dashboard. |
| Visitor journeys | A random session identifier, page order, entry and exit pages, pageviews, active time, and engagement status for one visit. |
| Traffic sources | Traffic channel, referring website hostname, and supported UTM or ref campaign values captured when a session starts. |
| Location and technology | Device type, browser, operating system, country, region, and city used for dashboard breakdowns. |
| Interactions | Approximate click positions, rage clicks, dead clicks, and scroll-depth ranges used for interaction analytics and heatmaps. |
| Events and conversions | The event name you define and, when supplied, a numeric value and currency code for a conversion or product action. When you enable Polar synchronization, TypeUI separately stores the organization access token with authenticated encryption in Supabase Vault. Polar order responses are minimized to the provider, confirmed amount, refunded amount, currency, status, time, hashed order identifier, opaque event identifier, and an optional pseudonymous session and route reference. TypeUI does not retain the customer identity, payment-method details, line items, order metadata, or raw Polar response. |
| Heatmaps | A screenshot you request of a public page, stored privately as the visual background for its heatmap. |
| Bots | Cloudflare signals and temporary request details used to detect automation and protect the collector. Your analytics keeps only the total number of detected bot requests. |
How a visitor session works
After you enable analytics consent, the tracker saves a random value in the visitor's local storage so it can connect pages within one visit. The session ends after 30 minutes of inactivity. The value is not meant to recognize someone across different sessions, websites, or devices. Withdrawing consent removes it and stops future collection.
The live count includes sessions with event activity in the previous 90 seconds. This is an approximate recent-presence signal, not a precise count of identifiable people, and it can be affected by network delay, browser behavior, consent settings, and bot filtering.
What the tracker leaves out
TypeUI Insights is designed not to collect or store:
- names, email addresses, account IDs, or advertising identifiers;
- typed text, keystrokes, form or input values, or page DOM content;
- query strings, URL fragments, or complete referrer URLs and paths;
- CSS selectors or the text of the clicked element;
- raw IP addresses or complete user-agent strings in analytics;
- arbitrary custom-event metadata or object properties; or
- plaintext payment-provider API keys in analytics records, customer identity, payment-method details, line items, or order metadata; an optional Polar access token is stored separately with authenticated encryption only while the integration is connected;
- fingerprints or a cross-site visitor identifier.
Like any web service, our infrastructure receives connection details such as an IP address and user-agent header while handling a request. TypeUI uses them at the edge to derive broad location and technology categories, but does not save the raw values in your analytics.
How plan usage is counted
Each paid Insights tier has a pageview allowance and an included custom-event allowance equal to 10% of it, shared across all websites in the workspace over a rolling 30-day window. Quota usage equals pageviews plus customer-defined custom events above that included amount. If current subscriptions exist through Stripe and Polar, one current allowance from each provider is added together; an upgrade or downgrade replaces the prior allowance within that provider. Every excess custom event counts as one pageview-equivalent quota unit; sessions and automatically collected interaction signals such as clicks and scroll-depth measurements do not consume the custom-event allowance. If an incoming batch would cross the combined allowance, TypeUI rejects the complete batch before saving its sessions, events, journeys, archives, or related recovery data. Other service-protection controls do not change the customer's paid allowance.
Keep campaign and event names private
Insights reads supported UTM and ref values to build campaign reports. Do not put names, email addresses, account IDs, or sensitive information in campaign values, event names, page paths, or public URLs. Custom events accept a restricted name and may include only a number and currency code.
How heatmap previews work
TypeUI captures a preview only when you request one from your authenticated dashboard. It loads the public page and stores a private image for the selected route and screen size. Check the page before capturing it and exclude personal, confidential, or sensitive content. The stored image is not a public asset.
How shared dashboards work
Every website dashboard starts private. After a website is verified, its owner can keep it private or deliberately create a read-only unlisted, password-protected, or public shared dashboard. Shared views can show live visitors and only the report sections selected by the owner, but cannot change the website, tracking, recovery, or sharing settings. The aggregate sessions, pageviews, average-time, and bounce-rate cards are always included. Campaigns, custom events, individual user sessions, scroll depth, and heatmaps are excluded by default. Disabled sections are removed server-side and are not serialized into the shared response. When individual sessions or linked conversion events are shared, their session identifiers are replaced with site-specific one-way values rather than the identifiers used in the private dashboard.
Shared access uses protective access controls. Unlisted and password-protected dashboards instruct search engines not to index or archive them; only public mode is intended for indexing. These measures cannot prevent someone who receives a link or password from forwarding it. The website owner is responsible for choosing an appropriate mode and explaining any public analytics disclosure where required.
How we use your analytics data
We use Insights data to build your reports, calculate usage, filter bots, protect and maintain the service, help you with support requests, carry out deletion requests, and follow the law. We do not sell your visitor analytics, use it for third-party advertising, or build visitor profiles across different customers. We share it only with providers needed to run TypeUI or when the law requires us to.
Where your data is stored
Cloudflare receives tracker requests, derives coarse request context, filters bots, enforces rate limits, and stores your analytics in isolated databases for your website. Private heatmap previews and recovery copies use separate private Cloudflare storage configured with the EU jurisdiction. Vercel hosts the signed-in TypeUI dashboard, while Supabase stores your account, workspace, website, permissions, and plan information rather than your main analytics events.
Cloudflare operates a global edge network, so request processing and temporary service data may pass through other countries. Configuring private preview and recovery storage for the EU does not mean every part of the service runs only in the EU.
How backups protect your analytics
TypeUI keeps restricted recovery copies separately from live analytics to reduce operational risk. They are not public or available through your dashboard.
A restore may not include the latest activity. Recovery copies reduce risk but do not guarantee that every event can be recovered or replace your own exports.
How long we keep your analytics
Detailed sessions, their page-by-page journeys, and connected custom events are available for a rolling 90 days per website. Lightweight aggregate traffic, engagement, and UI-interaction totals remain available while your Insights subscription is active. See the Data Retention page for the full lifecycle.
If your access ends, collection pauses and a 30-day recovery period begins. Resubscribing during that period keeps data that has not already reached its normal retention limit. If you do not return, we automatically delete the website analytics, tracker settings, and private heatmap previews.
You can also delete a website and its analytics from the dashboard at any time. TypeUI removes the live copy immediately and you cannot undo the deletion through the product. An isolated recovery copy may remain inaccessible for up to 32 days under its protected retention period. Scheduled cleanup removes it after that window.
What you control
You control installation, consent, registered websites, custom events, heatmap captures, shared-dashboard visibility, workspace access, and deletion. TypeUI is not a permanent archive, so export anything you are required to keep. Like any online service, analytics may occasionally be delayed, unavailable, corrupted, or lost. The Terms of Service explains the service limitations and available remedies.
Traffic classification, location, technology, engagement, and live presence are estimates. Some automated traffic may pass filtering and some legitimate traffic may be excluded. TypeUI and its providers can experience failures or security incidents despite their safeguards; no analytics or recovery system is guaranteed to be complete or error-free.