Security and privacy

Свързваш real accounts. Ето как се грижат за тях.

Your provider accounts

• Read only. Metribay само read — never post/edit/delete. Read-only access къдeto provider offers — integration guides.
• Least access. Само tracked resources.
• Encrypted at rest. Keys, tokens, passwords, service account keys.
• Never shown again. Not in app, errors, logs, exports. Not even owners.
• Workspace-bound. Own workspace; Cloud owners only add/change.
• Public HTTPS only. No redirect follow elsewhere.
• Your access. Cloud reads only through your accounts, never shared Metribay account.

Revoke anytime at provider: remove service account, delete token, regenerate key.

Your Metribay account

• Двуфакторна автентикация — Profile and security.
• Roles — Team members and roles.
• Private sign-up/recovery — never reveals if email has account.

Where your data lives

Metribay Cloud: Hetzner Finland, EU. Cloudflare front + emails. Paddle payments.

Nightly DB backup; Hetzner daily server backup.

Self-hosted: your server, only providers you connect.

What Metribay stores

• name, email, password (hashed),
• workspaces, projects, data sources, events, team,
• encrypted provider credentials,
• daily metrics from providers.

Daily totals (visitors, clicks) — not individual visitor data on your sites.

Details: privacy policy.

Deleting your data

• Stop collecting: pause data source or archive project. History stays.
• Revoke access: remove at provider → Needs attention, history stays.
• Delete account: [email protected] from account email, 30 days. Backups roll 14 days. Billing per tax law.

Copy, correction, restriction requests — answer within one month.

Reporting a security issue

Vulnerability: [email protected] with details before public disclosure.