Cookieless analytics by default
Core browser tracking does not set LeetLytics cookies. Customers may send their own pseudonymous identifiers when needed; identity stitching is not required for the core dashboard.
Trust through product behavior.
How LeetLytics protects workspaces today — cookieless defaults, hashed credentials, server-only secrets, and workspace-scoped ingest controls. Product-true only; no compliance theater.
Default stance
Privacy-forward analytics without a surveillance stack.
Security here means the controls that ship in the freemium product: what the browser can send, what the dashboard stores, and what we deliberately refuse to collect. For legal wording on processing, see Privacy. For install and key handling, see Install and Docs.
Public workspace keys vs conversion secrets
Browser snippets, WordPress, and storefront pixels use a public workspace key meant for client-side install. Conversion API keys are private backend credentials: minted once, stored hashed, never shown again in the dashboard, and never placed in browser snippets.
Passwords hashed with scrypt
Email + password is the primary dashboard auth path. Password credentials are stored as versioned scrypt hashes only — raw passwords are never persisted or logged.
HttpOnly session cookies
Signed-in dashboard access uses a leetlytics_session cookie set HttpOnly (and Secure in production). Session tokens are hashed before storage; logout revokes the session row and clears the cookie.
Hostname allowlists
Workspaces can restrict browser ingest to exact hostnames or wildcard subdomain patterns. Events from hosts outside the allowlist are rejected before journey lookup or dashboard persistence.
Path exclusions
Workspaces can suppress sensitive or non-product pages with exact paths or prefix patterns. Excluded events are accepted by the browser SDK but not stored as analytics.
No session replay or keystrokes
LeetLytics does not ship session replay, keystroke capture, screen recording, or fingerprinting. The product stays focused on traffic, pages, events, breakages, health, and alerts.
Auth email via Resend
Optional one-time codes, magic links, and password-reset emails are sent through Resend when configured. Transactional auth mail is server-side only; message bodies do not include API keys, session tokens, or conversion secrets.
Operational data on Neon Postgres
Analytics, auth, billing state, and workspace settings live in Neon Postgres as the only operational database. Residency follows the Neon project region configured for the environment — we do not claim multi-region customer choice or third-party compliance certifications on this page.
What we do not claim
No SOC 2 theater. No invented certifications.
This page describes implemented product behavior for the current launch surface. It is not a SOC 2 report, ISO certificate, GDPR/CCPA certification badge, or data-processing agreement. For security, access, or deletion questions, contact hello@leet.fyi.