Analytics & Privacy

YourSpace measures how your site is doing — request volume, live concurrency, error rates — keyed to your site, not to the people visiting it. This page is the contract: what your analytics record, the shape of that data, and how long it is kept. It is a product promise, not a footnote, so it is written down where you can read it before you trust it.

What we measure

Every site gets a small set of aggregate counters, keyed by the site's own hostname — the subdomain you deploy under (and any custom domain you've verified). These are sampled once a minute at the edge:

• Requests — how many requests your site served in the last interval. A running per-minute count, nothing more.
• Concurrency — how many requests were in flight at the moment of the sample. The "how busy is this site right now" number.

That is the whole per-site record. One row per site per sample looks like this on the wire:

{
  "host": "my-blog.yo.urspace.net",
  "requests_delta": 128,
  "in_flight": 2
}

The only identity in that row is host — your site's own name. The analytics carry no field for who made the requests, what they asked for, or where they came from — the counters are keyed to your site, not to the people hitting it.

Across the platform as a whole, we also keep a count of responses by status class — how many 2xx, 3xx, 4xx, and 5xx responses went out in each interval. This is a platform-wide total used to watch overall health; it is not broken down per visitor, and per-site error breakdowns are not kept today.

No per-visitor dimension

• No visitor profiles, by construction. The analytics have a single dimension — your site — and no per-visitor dimension to attach an identity to. Site-level health metrics, not per-person surveillance.
• Sessions, funnels, and "live visitors." Per-site means per-site, not per-visitor. There is no session tracking, no funnel reconstruction, no real-time visitor list, and no cross-page journey. Aggregate counts only.

"Aggregate-only" is the design, not a setting you opt into.

Do Not Track and Global Privacy Control

Because the analytics carry no per-visitor data, there's nothing in them for Do Not Track or Global Privacy Control to suppress — your visitors' signals are respected by design.

How long anything is kept

The counts are retained in tiers, coarser the further back you look:

Every tier holds the same kind of data this page describes — aggregate site counts, never visitor records. The retention horizon is a ceiling: raw per-minute detail ages out within a day, leaving only the summarized shape behind it.

Who can see it

Your site's analytics are visible only to you, behind your bearer token. They are never shown on the public status page, which carries only platform-wide "is YourSpace itself up" signal. Reading your own counts is an authenticated call:

$ curl https://api.yo.urspace.net/v1/sites/my-blog/metrics?metric=requests&window=1d \
    -H "Authorization: Bearer $YOURSPACE_TOKEN"

{
  "site": "my-blog",
  "metric": "requests",
  "interval_seconds": 60,
  "samples": [ { "at": "2026-06-01T09:12:00Z", "value": 128 }, ... ]
}

The response is a plain time series — a count per minute — scoped to the one site named in the path and gated by your token. The same data backs the traffic charts on your dashboard.