Privacy Policy

Lookout (lookoutstats.com) shows analytics from your Vercel projects in one dashboard. This policy explains what we collect, why, and the choices you have. Questions: privacy@lookoutstats.com.

What we collect

• Account data. Your name, email address, profile picture and sign-in method, plus the workspaces you belong to and your role in each. Sign-in is handled by Clerk.
• Vercel tokens you paste. Encrypted with AES-256-GCM before they are stored, decrypted only in memory to call Vercel, never shown again, and deleted when you disconnect the team or delete the workspace, or when the member who pasted it leaves or is removed from the workspace.
• Data from Vercel. Project names, frameworks and domains, and aggregated Web Analytics: visitor and page-view counts, top referrers, countries, pages, devices, browsers and operating systems, and the names and counts of your sites' custom events. Analytics are cached to keep the dashboard fast and are normally refreshed within 75 minutes; the last good figures are kept up to 24 hours to show during a Vercel outage, and figures for a past date range, which no longer change, up to 7 days. They are not stored in our database.
• Deployments. To mark deploys on charts, we read each site's production and preview deployments from Vercel: when each was made, whether it succeeded, and, for deploys from Git, the commit message's first line, the branch and a short commit hash. Only signed-in members of the workspace see them, never a shared board link. They are cached like analytics: normally refreshed within 30 minutes, kept up to 24 hours to show during a Vercel outage, and up to 7 days for a past date range. They are not stored in our database.
• Chart notes. Owners can add short notes to a board's chart days. A note's text, its day, its site and who wrote it are stored with the board and seen by all its members, never on a shared board link. Notes are deleted when the owner deletes them, or with their site, board or workspace.
• Pins and tags. Your pins are your own: the sites you star, stored per user in each workspace and seen by no one else. They are deleted when you leave the workspace or delete your account. Tags are short labels on a workspace's sites, seen by all its members; owners add and remove tags. Both are deleted when the site leaves the workspace or the workspace is deleted.
• Goals. Owners can pick one of a site's custom events as its goal. The event's name, the site, who set it and when are stored with the workspace and seen by all its members, and the goal's name and its conversions show on the workspace's shared board links; a site's other custom events never show on a shared link. A goal is deleted when an owner clears it, or with its site or workspace.
• Getting started. To list a connected team's projects without Web Analytics, even those you never added to Lookout, we store up to 50 of them per team (name, domain and framework) with the team's project counts. Lookout checks again every hour while a team has such projects, and when an owner asks it to; only owners see their names. The list is replaced at each check, and deleted when the team is disconnected, the member who connected it leaves, or the workspace is deleted. We also store whether you hid the Getting started checklist, per user in each workspace, and delete it when you leave the workspace or delete your account.
• Exports. A PNG, PDF or CSV of a board is rendered on our server from the board's figures when you ask for it, and not stored beyond a 60-second cache in the server's memory. If an export contains characters our bundled fonts lack, those characters are sent to Google Fonts to fetch matching glyphs; Hebrew and Latin text never leave our server.
• Shared board links. If an owner turns on the public link of a board, anyone with the link can see that board's site names, domains and analytics (visitors, page views, pages, devices, browsers and operating systems, and referrers and countries if the owner includes them) without signing in. We store the link encrypted, so the owner can copy it again, and we find it by a hash. The owner can set a password, which we store only as a hash, and make the link expire after 7 or 30 days. A viewer who enters the password gets a cookie that keeps the page unlocked in that browser for 12 hours. Our hosting provider's request logs may record the link for a short time. Resetting the link, turning it off, letting it expire, or disconnecting the team whose sites are on the board ends access on the next request. Shared pages are not indexed by search engines.
• Notification emails. If an owner turns on the weekly digest, every member of the workspace gets one email a week at 09:00 in the owner's timezone (which we store for this), with the chosen boards' totals and biggest movers. An alert emails the owner who created the alert (or every owner, if they have left the workspace) when a board's figures move past its threshold. We send these from notifications@lookoutstats.com through Zoho Mail, one email per recipient, using your account's email address from Clerk. We keep the alerts, the digest settings, a list of what was sent (Settings shows its last 30 days), until the workspace is deleted, and who has unsubscribed, until they leave the workspace or delete their account (so someone who rejoins starts with the default settings). The unsubscribe link in every email stops that kind of email from that workspace for you alone; you can turn it back on, or off, in Settings › Notifications.
• Scheduled reports. An owner can have a board emailed as a PDF or CSV on a schedule to up to 20 email addresses, which need not belong to Lookout users. We store the board, the schedule and its timezone, the recipients' addresses, the owner's note, and when the report was last sent; every member of the workspace can see them. Each email holds the board's figures for the period as an attachment, and a link to the board (its public link, if the owner turned that on). We send them from notifications@lookoutstats.com through Zoho Mail, one email per recipient, each with an unsubscribe link: it takes that address off every report of the workspace, and we keep the address so it can't be added back, until the workspace is deleted. To cap how many report emails a workspace sends a day, we count each send (the workspace and how many emails) and delete the count after two days. A report is deleted when an owner deletes it, or with its board or workspace.
• Board settings. Each board remembers the range, view and sort you last used on it, per user in each workspace (you can turn this off in Settings, which deletes them); they are deleted when you leave the workspace or delete your account. A board's site order and the order of the boards are set by owners and seen by all members. Owners can also dismiss projects that will never have Web Analytics: we store the project's id, who dismissed it and when, until an owner restores it or the workspace is deleted.
• API keys, the MCP server and webhooks. Owners can create API keys that read the workspace's boards and sites (and, if the owner allows, add chart notes and make export links), for our API and MCP server. We store each key's name, its first characters and a hash of it, never the key itself, its scopes, who created it, and when it was created, last used and revoked. Owners can also add webhook endpoints: we store each URL, its events and an encrypted signing secret, and send the chosen events (alerts, site spikes and drops, digests and reports sent, projects found or newly tracked) to it, as JSON or, for Slack and Discord, a message. For each delivery we keep the event, its content, the endpoint's host and its answer's status and timing for 30 days. Keys, endpoints and deliveries are deleted with the workspace.
• Welcome email. When you sign up, we send one welcome email to your account's primary email address from Clerk, from hello@lookoutstats.com through Zoho Mail. To send it only once, we record that it was sent to your account (your Clerk user id and when), and delete that record when you delete your account. It has no tracking pixels or tracked links.
• Invitations. When an owner invites someone to a workspace, the email address they enter goes to Clerk, which sends the invitation and keeps it until it is accepted, revoked or expires.
• Security log. Changes such as connecting or disconnecting a team, creating, editing or deleting a board, adding or removing a site's tags, setting or clearing a site's goal, turning a board's public link on, off or resetting it, changing members' roles or removing them, creating, editing or deleting an alert, changing the weekly digest, adding, editing or deleting a chart note, and deleting a workspace, with the IP address and browser that made them. A workspace's security log is deleted with the workspace, so deleting a workspace is recorded in our server logs instead (the workspace and the account that deleted it).
• Support and account administration. Lookout's staff use an internal operator console, open only to admin accounts, to run the service and help you. It shows each account's name, email address, sign-in method, workspaces and role, when it was created and last active, and its active sessions with the device, city and country Clerk records, and each workspace's members, connected teams, recent security log entries and counts (sites, boards, alerts, share links), never your analytics figures or Vercel tokens. To investigate a problem, staff can sign in as you for at most 10 minutes; the app then shows a bar saying so, and the session is read-only: they can see what you see, but can't change or delete anything. Staff can also set a workspace's plan, suspend it (its dashboards, share links and emails pause and its data is kept; every member of the workspace sees the reason staff give; an owner can still delete it), end sessions, and lock, ban or delete an account. A workspace's plan and suspension are deleted with the workspace. Every one of these actions goes in our admin audit log (which staff member, the action, the account or workspace id and the reason given), which is kept after the workspace or account is deleted, as our record of what staff did.
• Our own site analytics. Vercel Web Analytics on lookoutstats.com: cookieless, aggregated page views, with URL query strings removed, and anonymous sign-up steps (signed up, token verified or rejected with its error code, team connected, board created, dashboard loaded) carrying only counts and error codes, never names, domains or tokens. Vercel Speed Insights measures how fast pages load (Core Web Vitals), also cookieless and with URL query strings removed; on shared board pages, neither records the link.
• Error reports. When something breaks, a technical report goes to Sentry. Tokens, credentials, cookies, request bodies and URL query strings are removed before it is sent.

What we don't do

• We don't sell or rent your data, and we don't use it for advertising.
• We only read from Vercel. Lookout never deploys, changes settings or reads environment variables.
• We don't use advertising or cross-site tracking cookies.

Cookies

Clerk sets the cookies that keep you signed in. Lookout sets one cookie per workspace that remembers the last board you opened, so the app opens on it, and a shared board's unlock cookie as described above. Your browser's local storage keeps the same last board, the order of each board's cards, and the last few items you ran from the command palette, kept separately for each workspace and account (as ids, never names or figures), and the framework you last picked in the Enable analytics guide; it stays in your browser and is never sent to us. Signing out clears Lookout's local storage and its last-board cookie from that browser. None of these contain advertising identifiers.

Service providers

• Vercel: hosting and our own site analytics.
• Clerk: sign-in, accounts, workspaces and invitations.
• Neon: our database, in Frankfurt, Germany.
• Upstash: rate limiting and short-lived coordination data.
• Sentry: error reports, scrubbed as described above.
• Zoho: sends the welcome, digest, alert and scheduled report emails (Zoho Mail).
• Google Fonts: glyphs for characters in an export that our bundled fonts lack, as described above.

Each processes data only to provide its service to us.

How long we keep data

Account data, and the record that your welcome email was sent, are kept until you delete your account. A workspace's connections, tracked projects and security log are deleted when the workspace is deleted, and your pins and unsubscribes when you leave it or delete your account. Notification settings, alerts and the list of sent notifications are deleted with the workspace; the list itself only shows the last 30 days. A workspace's plan and suspension are deleted with it; the admin audit log is kept, as described above. Chart notes and goals are deleted with their site, board or workspace. Cached analytics are normally refreshed within 75 minutes; the last good figures are kept up to 24 hours to show during a Vercel outage, and figures for a past date range, which no longer change, up to 7 days.

Your choices and rights

You can disconnect a Vercel team in Settings while another team stays connected, or when it has lost access (deleting the workspace removes the last working one), and revoke its token in Vercel. You can ask us to access, correct, export or delete your data by writing to privacy@lookoutstats.com. We answer within 30 days.

Security

Tokens are encrypted at rest, workspaces are isolated from each other in the application and in the database, and every request is authenticated. To report a vulnerability, write to security@lookoutstats.com.

Changes

We will update the date above when this policy changes, and email you before material changes take effect.