Security
The strongest privacy guarantee is data you never collect. PulseKit AI's security model starts at the schema; the fields that would identify a person simply don't exist.
The tracker stores nothing on the visitor's device. There is no cookie to consent to, no localStorage token, no fingerprint composed from fonts or canvas. A consent banner is not 'disabled'; there is nothing it would need to cover.
A visitor is recognised by an HMAC of the site id, a daily salt, the request IP and a coarse user-agent class. The salt rotates every UTC midnight, so yesterday's identifier cannot be linked to today's. The raw IP is an argument and a local variable; it is never stored, logged or queued.
Do Not Track and Global Privacy Control are enforced at the collector, before anything is queued. A browser that asks not to be counted is not counted, rather than filtered later in the dashboard.
Control-plane data (accounts, sites, keys) lives in Postgres. Analytics events live in ClickHouse. The only process that reads ClickHouse is the query gateway, and it answers signed query envelopes; the public API cannot reach the event store directly.
Tracking keys are public-write-only by construction; they can enqueue an event and nothing else. Management keys are prefixed, revocable and stored hashed. Secrets never reach a log line, an error message or a response body.
The same codebase runs on your hardware: Postgres, ClickHouse, Valkey and the services, from one compose file with generated secrets. For the strictest data-residency answer, the honest one is 'it never leaves your machines'.
The tracker sends the URL, referrer, coarse timing and device class, and that's the list. City-level geolocation is opt-in per site and resolved against a GeoIP database on local disk, never a third-party API.
Site deletion is a real deletion: an erasure job removes events, sessions and rollups, not a flag on a row. Exports ship the same data the dashboard reads.
Architecture
Collector validates, rate-limits and queues; events land in ClickHouse via the worker, never the request path
Postgres 17 for the control plane, ClickHouse for events and rollups, Valkey for the durable queue and realtime cache
Query gateway validates Ed25519-signed envelopes; the API never talks to the event store
Caddy terminates TLS; security headers are set per-route, including frame-ancestors for embeds
Responsible disclosure
We take every report seriously and respond quickly. Please use the private contact channel below so we can investigate and fix an issue before it is disclosed.
Report a vulnerabilityThe fine print, honestly