Privacy policy
We built Humansift to count people, not to follow them. This page explains what we collect, why, and what you can do about it.
We don't sell data, we don't show ads, and we never store the IP addresses of the people who visit sites measured with Humansift. Google Analytics runs on humansift.com only if you allow it. Questions go to [email protected].
Who we are
Humansift ("we", "us") runs humansift.com and the Humansift app, a service that sorts the traffic reaching a website into people, crawlers, bots and attacks. For anything about your data, write to [email protected].
This policy covers two different roles. For visitors to humansift.com, waitlist members and account holders, we decide how data is used. For the traffic data of websites our customers connect, the customer decides, and we process it on their behalf.
Visiting humansift.com
Our own measurement
humansift.com uses Humansift's own script, the same one our customers use. It sets no cookies and stores nothing in your browser. It sends the page address, the referring page, screen and window size, time zone, a few signs of whether the browser is automated, whether you interacted with the page, how long it was in view, page-speed timings, and the name of any form you sent (never what you typed into it).
Each visitor is counted as a short code made from a hash of the day, the IP address and the browser's user agent. The code changes every day, so you can't be followed from one day to the next, and the IP address itself is not stored. We also look up the country and network the address belongs to, using a database on our own server.
Server logs
Like almost every website, our web server writes a standard access log: IP address, time, page requested, response, referrer and user agent. We use it to keep the site secure and working, and we sort it with Humansift the same way (IP addresses hashed, not stored). The raw log files are deleted after 14 days.
Google Analytics, only if you allow it
If you choose "Allow" in the banner, we load Google Analytics 4, which sets cookies (such as _ga) to measure visits and which pages help people. If you choose "No thanks", Google Analytics isn't loaded at all. Your choice is saved in your browser's local storage, and you can change it any time with the cookie settings link at the bottom of every page. Google processes this data under its own terms; see how Google uses information from sites that use its services.
Other cookies
Pages with a form set a csrftoken cookie that protects the form from being sent by another website. When you log in, a session cookie keeps you logged in. Both are strictly necessary and aren't used for measurement.
The waitlist
When you join the waitlist we keep your email address, which form you used and the page you came from. We use them to tell you when early access opens and to send occasional product news; every email has a way to stop them. Waitlist entries are kept until you ask us to remove yours or the waitlist closes.
The free tools
The site scan reads only public files on the domain you enter: its home page, robots.txt and sitemap. The result is kept for 10 minutes so a repeat check is quick, then deleted. Log lines you paste into the log analyzer are sorted in memory and discarded when the result is sent back; nothing from them is stored. An address you enter in the crawler checker is looked up and not kept. To stop abuse, we count how many checks each IP address runs; that count expires after 10 minutes.
Your Humansift account
For an account we keep your name, email address, a securely hashed password, your workspaces and team members, and the settings you choose. We send account emails such as verification, password resets, alerts and reports you set up.
If you connect Google, Humansift asks only for read-only access to Google Analytics and Search Console, plus your email address to show which Google account is connected. We use it solely to show those numbers next to your traffic, and only for properties that belong to the domains in your workspace. The access token is stored encrypted. You can disconnect at any time in the app, which revokes our access with Google, or remove it from your Google account settings. Humansift's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: we don't use it for advertising, don't sell it, and don't let people read it except where you ask us to for support, where security requires it, or where the law does.
Traffic data from your websites
When you connect a website, Humansift receives the requests that reach it, through your server logs, Cloudflare, file uploads or our script. For each request we keep the time, page, response, referrer, user agent, country and network, and the daily visitor code described above. Visitors' IP addresses are never stored: they're used once, to check crawler identity and look up the network, and then reduced to a hash that changes daily. Uploaded log files are deleted as soon as they're imported.
Request-level details are kept for your plan's retention period (14 days on the free plan, 35 days on paid plans) and then deleted; daily totals are kept for as long as the site is in your account. For this data you are the controller and we act as your processor: we use it only to provide the service to you. If your visitors ask about their data, please contact us and we'll help.
Who processes data for us
| Service | What for |
|---|---|
| Amazon Web Services (Singapore) | Hosting the website, app and database |
| Cloudflare | Domain name, network security, forwarding mail sent to our address |
| Brevo | Sending email: waitlist, account emails, alerts and reports |
| Google Analytics on humansift.com (only with your consent); the Google APIs you choose to connect |
We don't sell or rent personal data, and we don't share it with anyone else except where the law requires it. Because our servers are in Singapore and these services work internationally, your data may be processed outside your country; we use providers that commit to protecting it.
Your choices and rights
You can ask us for a copy of the personal data we hold about you, ask us to correct or delete it, object to how we use it, or withdraw a consent you gave. Write to [email protected] and we'll reply within 30 days. You can delete sites in the app yourself; to close a workspace or your account, just ask. Depending on where you live, you may also complain to your data protection authority.
Security
All traffic to humansift.com is encrypted with HTTPS, passwords are hashed, Google tokens are encrypted, and access to our servers is limited to the people who run the service.
Children
Humansift is a tool for website owners and isn't meant for children under 16. We don't knowingly collect their data.
Changes
If we change this policy, we'll update the date at the top. If a change affects how we use data you've already given us, we'll tell account holders by email before it takes effect.