Privacy Policy
Effective Date: June 12, 2026
Mitr Analytics ("we", "our", or "us") is operated by Shivansh Thakur, an individual sole proprietor based in Indore, Madhya Pradesh, India. This Privacy Policy details how we handle information in connection with our analytics platform, accessible at mitranalytics.dev.
1. Minimal Data Collection
We believe in privacy by design. Mitr Analytics collects only the absolute minimum application data necessary to deliver actionable insights to you. We do not engage in invasive behavioral tracking across the web. The metrics gathered are structural, high-level, and entirely focused on your system performance and interface interactions.
2. Cookie-Free Authentication
Mitr Analytics does not set or read cookies of any kind. Dashboard sessions are authenticated with PASETO tokens — issued at login, validated on every API call, and stored in your browser's secure local storage, never in a cookie. There is no document.cookie write anywhere in our codebase, on the marketing site, the dashboard, or the SDKs.
We also do not run canvas or audio fingerprinting, do not build a device fingerprint for tracking purposes, and do not load any third-party advertising or analytics scripts on this site or embed any cross-site tracking pixel.
Our SDKs also respect the Do Not Track browser signal: if it's set, no events are tracked for that visitor at all — not a reduced or anonymized version of tracking, none.
How anonymous visitor identity works. "No cookies" isn't by itself the property that determines whether a consent banner is needed — the relevant law (see below) regulates storing or reading anything from a visitor's device for non-essential purposes, which covers localStorage and similar client-side storage exactly the same as cookies. For an anonymous visitor (the default — no explicit identification), our SDKs write nothing to the device at all: no device ID is generated, nothing is persisted. Instead, the backend computes a pseudonymous identifier server-side from the request's IP address and User-Agent — data already present on every HTTP request regardless of what the SDK does — combined with a secret salt that rotates every 24 hours and is discarded after rotation. The same visitor's pageviews within one day resolve to the same identifier (so session-level metrics work normally), but that identifier has no relationship to the one the same visitor gets the next day, and the salt that could ever connect the two no longer exists by then.
A site's own app can optionally call identify(userId) to tie events to its own logged-in user accounts instead of anonymous tracking. That id is hashed client-side (SHA-256) before it's sent, and is persisted locally so it survives across sessions without calling identify() again — functionally comparable to a login/session token, and a decision made by the integrating app for its own users, not something applied to anonymous visitors.
4. Data Security and Encryption
Your dashboard data and operational metrics are protected with modern, industry-standard cryptographic practices:
- In transit: all traffic — SDK ingestion, dashboard API calls, and this website — is served exclusively over HTTPS/TLS. Plaintext HTTP is not offered.
- User identifiers: both the JavaScript and Flutter SDKs hash user identifiers with SHA-256 client-side, before they ever leave the visitor's device — the backend receives and stores a hash, never a raw email, name, or other identifier.
- Access scoping: every API endpoint checks workspace ownership before returning data, so one client's data is never visible to another.
- At rest: encryption at rest is part of our production hosting setup — this policy will be updated to confirm it's active once infrastructure is live.
You can see this hashing step happen live in the interactive demo on our Trust page.
5. Third-Party Sharing Policy
We do not sell, rent, monetize, or trade any personal or operational application data to third-party brokers, advertisement companies, or external marketers. Data is only handled by infrastructure sub-processors (our hosting provider, Vultr, and our payment processor, Razorpay) strictly required to operate the basic delivery of the software. See our Trust page for the full sub-processor list.
6. User Rights and Data Deletion
You hold comprehensive rights over your registration profile. You can update or entirely delete your Mitr Analytics account profile along with its associated records at any moment via your dashboard profile settings, or by submitting a formal request via email.
Rights of your visitors (end users). Because Mitr never stores a raw identifier for the people visiting your site or app — only a one-way hash — we have no way to identify, contact, or independently locate a specific visitor's data ourselves. If one of your visitors exercises a right to erasure or access with you directly, you can act on it: every event is keyed to an opaque hash visible in your dashboard, and deleting a visitor's data by that hash is a self-service action from there. We do not process visitor-erasure requests submitted directly to us, since we have no way to match a name or email to any data we hold.
Retention. Data is retained according to your plan's retention window. Once an event ages past that window, it is marked for deletion and held for a 30-day grace period before permanent removal — the grace period exists so a mistaken deletion can still be recovered on request within that window. Workspaces on plans with unlimited retention are not subject to automatic deletion.
Portability. You can export the raw events held for any of your apps, for any date range, as CSV or JSON, directly from your dashboard.
Privacy & Compliance Inquiries
For any clarifications regarding data protection or compliance structures, please contact the platform owner directly: