Privacy Policy

Last updated: May 2025

This Privacy Policy describes how Statiq collects, uses, and stores information when you use this service. By using Statiq, you agree to the practices described here.

1. Information We Collect

Account data: When you create an account, we store your email address and a bcrypt-hashed password. We never store your password in plaintext.

Session data: We issue session tokens stored as SHA-256 hashes. A session cookie is set in your browser. Sessions expire after 24 hours of inactivity.

Site content: Events, announcements, popups, testimonials, email templates, contact submissions, and subscriber lists that you create are stored in the database and associated with your account.

Analytics: When a visitor loads a page with the Statiq widget, we record the page path, referrer domain, device category, and a daily visitor hash. The hash is derived from the visitor's IP address, user agent, site ID, and the current UTC date — it resets each day and is never stored as a raw IP address. We do not use cookies for analytics.

2. Information We Do Not Collect

• We do not track visitors across sites
• We do not store raw IP addresses for analytics
• We do not sell data to third parties
• We do not use advertising networks or tracking pixels

3. Third-Party Services

Groq / LM Studio: If AI features are enabled, your content (form fields, email drafts, analytics summaries) may be sent to Groq's API or a locally-configured LM Studio instance for processing. Groq's own privacy policy applies to data sent to their API.

Resend: If email sending is configured, subscriber email addresses and email content are transmitted to Resend to deliver transactional and broadcast emails. Resend's privacy policy applies.

4. Data Retention

• Analytics events older than 365 days are automatically deleted
• Expired sessions and password-reset tokens are purged hourly
• You can delete your account and all associated data at any time from Settings → Delete Account

5. Data Security

Credentials stored in the database (API keys, SMTP passwords) are encrypted at rest using AES-256-GCM. Passwords are hashed with bcrypt. All connections should be served over HTTPS.

6. Your Rights

You may access, correct, or delete your data at any time through the admin dashboard. To delete your account and all associated data, go to Settings → Delete Account. If you need further assistance, contact the administrator of this Statiq instance.

7. Changes to This Policy

We may update this policy from time to time. Continued use of the service after changes constitutes acceptance of the updated policy.

8. Contact

Questions about this policy can be directed to the administrator of this Statiq installation.