We built PastelTrack with transparency in mind. Here's exactly what we collect, how it's accessed, what our administrators can do, and what controls you have.
By embedding the PastelTrack tracking snippet on your website, you automatically agree to these Terms of Use and Privacy Policy. No further action is required — the act of installing the code constitutes acceptance. If you do not agree, you must remove the tracking snippet from your site immediately.
This agreement is entered into between you (the website owner, hereafter "Site Owner") and PastelTrack ("we", "us", "our"). By embedding the PastelTrack widget code on any web property, the Site Owner acknowledges and agrees that:
If the Site Owner is acting on behalf of a company or other legal entity, they represent that they have the authority to bind that entity to these terms.
PastelTrack ("we", "us", "our") is a free, lightweight visitor analytics service for websites. This policy explains how we handle data when our tracking widget is embedded on a website, and when you use the PastelTrack analytics dashboard at pasteltrack.minidu.lk.
The short version: We count visitors and collect basic technical data (IP, OS, browser, country) to help website owners understand their traffic. Full IP addresses are visible only to verified domain owners. Public viewers see only totals. No cookies are set on visitors' browsers. PastelTrack administrators retain certain rights over all registered sites as described in this policy.
By using PastelTrack — either by embedding the widget or by visiting this site — you agree to the practices described in this policy.
When a visitor loads a page with the PastelTrack widget, our server receives and processes the following data:
| Data point | Purpose | Stored? | Who sees it |
|---|---|---|---|
| Page URL visited | Show which pages are being visited | Yes | Owner + Read-only + Admin |
| Referrer URL | Show where visitors came from | Yes | Owner + Read-only + Admin |
| Timestamp of visit | Daily and total count tracking | Yes | Everyone |
| IP address | Session deduplication and visitor identification | Yes | Owner + Admin only |
| Operating System | Visitor analytics breakdown | Yes | Owner + Read-only + Admin |
| Browser name | Visitor analytics breakdown | Yes | Owner + Read-only + Admin |
| Country (via CF-IPCountry) | Visitor geography analytics | Yes | Owner + Read-only + Admin |
| User-Agent string | Bot detection and OS/browser parsing | Not stored | N/A |
| Watermark compliance flag | Detect if attribution widget is displayed | Yes | Owner + Admin |
All data is aggregated and associated with a site ID (the domain name). Session deduplication uses a SHA-256 hash of IP + User-Agent (stored as a 16-character session key) to prevent page refreshes from counting as new visits within a 30-minute window.
Important: Full IP addresses are stored in the recent visitor log (last 20 entries) and are visible only to the verified domain owner and PastelTrack administrators. Read-only invite links and public viewers cannot see IP addresses — they see ***HIDDEN*** instead.
PastelTrack has four access tiers. The data visible depends on how someone accesses your analytics:
Anyone with your site ID. Sees: total count, online now count, domain name, and whether DNS is verified. No recent visitor list, no IPs, no technical details.
Anyone with an invite link. Sees: all stats, daily counts, 30-day history, recent visitors with OS/browser/country, but IP addresses are masked as ***HIDDEN***.
Verified domain owner via secret key, magic link, or owner access link. Sees: everything including full IP addresses, full recent log, and can manage invites, rotate keys, and generate access links.
The PastelTrack platform administrators. Have elevated access including the ability to view all site data, post notices, and remove sites. See Section 5 for full details.
Domain ownership is verified via DNS TXT records. The owner secret is required for full access. We also support 30-day owner access links and single-use 15-minute magic login links for convenience.
By embedding the PastelTrack snippet, you acknowledge and accept the following administrative rights retained by PastelTrack. These rights exist to maintain platform integrity, enforce terms of service, and ensure abuse prevention.
PastelTrack administrators reserve the right to remove any registered site from the platform at any time, without prior notice, for any of the following reasons (including but not limited to):
Site removal resets all ownership verification data, accumulated statistics, and stored credentials for the domain. Removed sites may re-register through the standard verification process unless explicitly banned.
PastelTrack administrators have backend access to all data stored on the platform for all registered sites. This includes:
Administrative data access is used solely for platform operations: debugging, abuse prevention, security monitoring, and support. We do not use this access for commercial profiling or sell this data to third parties.
PastelTrack administrators may post notices (maintenance alerts, announcements, warnings) that appear in the analytics dashboards of registered site owners. These notices are used to communicate important platform information.
The PastelTrack tracking widget includes a watermark compliance check. Each tracking request records whether the PastelTrack attribution widget (the "Powered by PastelTrack" badge) is visible on the page. This compliance flag (wm_ok) is stored per visit and administrators can review the cumulative violation count for any site.
Free tier requirement: The PastelTrack watermark/attribution badge must remain visible on sites using the free tier. Removing or hiding the badge is a violation of these terms and may result in site removal. The number of violations is tracked and visible to administrators.
Aggregate visit data and visitor logs are stored in Google Firebase Realtime Database, hosted in the Asia-Southeast region. Data is accessed only via our Cloudflare Worker API, which requires a server-side authentication token — it is never exposed directly to the public.
We do not sell, share, trade, or transfer any data to third parties for commercial purposes.
The PastelTrack widget does not set any cookies or use localStorage/sessionStorage on a visitor's browser. The widget makes a single POST request to our API to register the visit and retrieve the current count, then it's done — no persistent state is written to the browser.
The PastelTrack analytics dashboard (pasteltrack.minidu.lk) itself does not set tracking cookies. It reads data from our API using the site ID in the URL query string.
We use Google Analytics (gtag.js) on the PastelTrack landing page only. Google Analytics may set its own cookies as described in Google's Privacy Policy.
PastelTrack uses the following third-party services to operate:
CF-IPCountry header to determine visitor country.We are not responsible for the privacy practices of these third-party services. We encourage you to review their respective privacy policies.
If you embed the PastelTrack widget on your website, you are responsible for informing your visitors that their visit is being counted and that technical data may be collected. We recommend disclosing this in your own privacy policy.
Suggested disclosure text you may adapt:
"This site uses PastelTrack to count visitor traffic and display basic analytics. PastelTrack collects page URLs, referrer URLs, timestamps, IP addresses (visible only to the site owner and PastelTrack administrators), operating system, browser type, and country. No cookies are set. See PastelTrack's privacy policy for details."
pasteltrack-owner=... TXT record active to maintain access.Sites using the free tier of PastelTrack must display the PastelTrack attribution badge ("Powered by PastelTrack") in a visible location on pages where the tracking widget is active. Hiding, removing, or obscuring this badge violates these terms. Violations are recorded automatically and may result in site removal.
As a visitor to a site using PastelTrack, you have the following rights and options:
As a website owner:
We may update this Privacy Policy and Terms of Use from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. When we do, we will update the "Last updated" date shown at the top of this page.
Continued use of the PastelTrack tracking snippet after policy changes have been posted constitutes your acceptance of those changes. We encourage you to review this policy periodically.
For significant changes that materially affect how we handle data or your rights as a site owner, we will make reasonable efforts to notify registered owners via the platform notice system.
If you have any questions, concerns, or requests regarding this Privacy Policy or PastelTrack's data practices, please get in touch:
Questions about privacy, data deletion requests, or anything else — we're happy to help.
info@minidu.lk