Security & Privacy
Databuddy is built with privacy-first principles and enterprise-grade security. This guide covers what we do to protect your data and how to configure privacy settings for your users.
Privacy-First Design
What We Don't Collect
What We Do Collect
Data Protection
Anonymous by Default
// All users get anonymous IDs - no personal data
{
anonymousId: "anon_abc123...", // Random UUID
sessionId: "sess_xyz789...", // Session identifier
event: "page_view", // What happened
path: "/dashboard", // Where it happened
// No names, emails, or personal data
}Local Data Storage
Privacy Compliance
GDPR Compliance by Design
Lawful Basis: Legitimate interest for website analytics
Databuddy is compliant by default - no consent banners or cookie notices required because:
No Consent Required
import { Databuddy } from "@databuddy/sdk/react";
function App() {
return (
<>
{/* No consent needed - privacy-first by design */}
<Databuddy
clientId="your-client-id"
trackPerformance
/>
{/* No cookie banner needed! */}
</>
);
}Why No Consent Needed:
Privacy Controls
Minimal Tracking Setup
// Essential analytics only
<Databuddy
clientId="your-client-id"
// Basic page tracking (automatic)
// Disable everything else
trackPerformance={false}
trackWebVitals={false}
trackOutgoingLinks={false}
trackErrors={false}
/>Development vs Production
const isProd = process.env.NODE_ENV === "production";
<Databuddy
clientId="your-client-id"
disabled={!isProd} // No tracking in development
// Production-only features
trackPerformance={isProd}
trackWebVitals={isProd}
/>;🔐 Security Features
Domain Protection
Access Control Settings
Configure allowed origins and IP addresses to control who can send analytics data to your website.
Allowed Origins
By default, Databuddy only accepts requests from your website's registered domain. To track analytics from third-party services (like Cal.com, embedded widgets, or other integrations), you need to add those domains to your allowed origins.
Access: Open Websites, select your site, then go to Settings → Security.
Default Behavior:
Supported Formats:
How It Works:
Example Configuration:
Allowed Origins:
- cal.com
- *.cal.com
- localhostAllowed IP Addresses
Restrict analytics requests to specific IP addresses or IP ranges using CIDR notation.
Supported Formats:
How It Works:
Example Configuration:
Allowed IPs:
- 192.168.1.1
- 10.0.0.0/8
- 172.16.0.0/12Use Cases:
Important: If you configure allowed IPs, make sure to include your production servers and any legitimate sources. Blocking legitimate traffic will prevent analytics collection.
Third-Party Integrations: If you use services like Cal.com, embedded widgets, or other integrations that need to send analytics from their domains, add those domains to your allowed origins.
Data Validation
Infrastructure Security
🛠️ User Privacy Controls (Optional)
Anonymous Data Only
Since Databuddy only collects anonymous data, users don't need to request data deletion - there's no personal data to delete! However, you can still provide opt-out controls if desired.
Optional Opt-Out Implementation
function PrivacyControls() {
const [trackingEnabled, setTrackingEnabled] = useState(true);
const handleOptOut = () => {
// Clear local anonymous ID
localStorage.removeItem("databuddy_anon_id");
// Disable tracking
setTrackingEnabled(false);
// Store preference
localStorage.setItem("databuddy_opt_out", "true");
};
return (
<div>
<p>
Analytics helps us improve our website. No personal data is collected.
</p>
<label>
<input
type="checkbox"
checked={trackingEnabled}
onChange={(e) => setTrackingEnabled(e.target.checked)}
/>
Enable anonymous analytics
</label>
<button onClick={handleOptOut}>Disable analytics</button>
</div>
);
}Why Data Deletion Isn't Needed
🌐 Global Privacy Settings
Respect Browser Preferences
// Check Do Not Track setting
const respectDNT = navigator.doNotTrack === "1";
<Databuddy
clientId="your-client-id"
disabled={respectDNT} // Respect browser privacy setting
/>;📋 Privacy Best Practices
1. Be Transparent
// Clear privacy notice
function PrivacyNotice() {
return (
<div className="privacy-notice">
<h3>We respect your privacy</h3>
<p>
We collect anonymous usage data to improve our website. No personal
information is collected. You can opt out anytime.
</p>
<a href="/privacy-policy">Read our privacy policy</a>
</div>
);
}2. Provide Controls (Optional)
// Optional privacy dashboard (not required since data is anonymous)
function PrivacyDashboard() {
return (
<div>
<h2>Analytics Preferences</h2>
<div>
<h3>Anonymous Data Collection</h3>
<p>Help us improve our website with anonymous usage statistics.</p>
<Toggle label="Page views" />
<Toggle label="Performance metrics" />
<Toggle label="Error tracking" />
</div>
<div>
<h3>Your Privacy</h3>
<p>✅ No personal data is collected</p>
<p>✅ No cookies are used for tracking</p>
<p>✅ Cannot identify individual users</p>
<button onClick={clearLocalData}>Clear local preferences</button>
</div>
</div>
);
}3. Honor Preferences
// Respect user choices
const privacySettings = getUserPrivacySettings();
<Databuddy
clientId="your-client-id"
// Screen views are tracked automatically
trackPerformance={privacySettings.allowPerformance}
trackErrors={privacySettings.allowErrors}
/>⚖️ Legal Compliance
Recommended Disclosures
Privacy Policy Should Include:
Cookie Notice:
Sample Privacy Policy Text
Analytics: We use Databuddy to collect anonymous website usage statistics
to help us improve our site. No personal information, cookies, or tracking
is used. All data is completely anonymous and cannot identify individual
visitors. Data is processed securely by Databuddy and used only for
understanding website performance and usage patterns.Minimal Privacy Notice
We collect anonymous usage statistics to improve our website.
No personal data or cookies are used.🛡️ Implementation Security
Content Security Policy
<!-- Add Databuddy to your CSP -->
<meta
http-equiv="Content-Security-Policy"
content="script-src 'self' https://app.databuddy.cc;
connect-src 'self' https://basket.databuddy.cc;"
/>Secure Configuration
// Environment-specific settings
const config = {
development: {
clientId: process.env.NEXT_PUBLIC_DATABUDDY_DEV_ID,
disabled: true, // No tracking in development
},
production: {
clientId: process.env.NEXT_PUBLIC_DATABUDDY_PROD_ID,
disabled: false,
},
}[process.env.NODE_ENV];
<Databuddy {...config} />;🆘 Support & Questions
Privacy Questions
If you have questions about privacy or data handling:
Data Requests
No data requests needed - Databuddy doesn't collect personal data that can identify users. If you have questions about our data handling:
What's Next?
How is this guide?