Privacy Policy
Analytics that does not follow anyone
Shoal exists because most analytics tools treat visitors as a resource to mine. Ours counts them and forgets who they were. This page is the specific version: what is stored, what is never stored, how long it lasts and who else is involved.
Last updated 22 October 2026
No tracking cookies
The script sets no cookies at all. Nothing to block, nothing to consent to, nothing to purge. The only cookie Shoal ever sets is your own sign-in session while you are in the dashboard.
No IP addresses stored
The address a request arrives from is used for one thing: mixing into a hash, then thrown away. It is never written to the database, and it is never logged alongside a visit.
No device fingerprinting
No canvas probes, no audio probes, no font measurement, no list of installed extensions. The browser is never interrogated for signals it did not already send.
A country, not a location
Country comes from the hosting edge as a two-letter code. Shoal never geolocates an address itself, and even when the edge offers a city, the city is discarded.
No third-party trackers
The script is served from Shoal, not from an ad network. Fonts are bundled at build time, so a page using Shoal makes no request to Google. Nothing is passed to Meta, Google or a data broker.
Deletion without asking
You do not have to email anyone to leave. Settings → delete account removes the account, its sites, its visits and its agent keys immediately, and there is no soft-delete copy in the app afterwards.
What we store
Everything below is the complete list. If it is not here, it is not collected.
Your account
Email address, an optional workspace name, your plan, whether you asked for product updates, and when the account was created.
Until you delete the account.
Your password
Handled entirely by Supabase Auth, which stores a salted hash. Shoal never receives the password and has no way to recover it, which is why a forgotten one is reset rather than looked up.
Until you delete the account.
Visits to your sites
The site, the UTC date, the path, the referrer, a device class (desktop, mobile, tablet or bot), a two-letter country code, and a daily visitor hash. No address, no user-agent string, no cookie, no name.
Free: a rolling 12 months, then deleted. Pro: kept until you delete it.
The monthly counter
How many page views each plan has used this calendar month, so the allowance on the pricing page can be enforced. It is one number per account per month, not a record of anyone's visits.
While the account exists.
Agent keys
A SHA-256 hash of each key plus a short prefix so you can tell them apart. The key itself is shown once, when it is created, and is not stored anywhere.
Until you revoke the key or delete the account.
Billing, if you subscribe
The Stripe customer and subscription identifiers, the subscription status, which price you are on, and the renewal date. Card details are entered on Stripe's own page and never reach Shoal's servers or database.
While subscribed, then as long as tax and accounting rules require.
What we never store
- Visitor IP addresses, even temporarily — they are hashed and discarded within the same request.
- Visitor user-agent strings, or anything else that could rebuild a fingerprint.
- Names, email addresses or accounts belonging to the people visiting your site.
- Cross-site identities. A visitor to two of your sites is two unrelated hashes.
- Cities, coordinates or precise locations.
- Advertising identifiers, or anything shared with an ad network.
- Your own visitors' data merged with data about you.
The visitor hash, plainly
Counting a visitor once, rather than once per page view, needs something to recognise them by. Shoal uses one thing: a hash of the request's address and browser signature, mixed with a secret and with today's date. It produces a 32-character code. That code is the only value that could group two requests together, and the address behind it is never written down.
The date is what expires it. The same person tomorrow produces a different code, so yesterday's cannot be matched to today's, and nothing can follow them into next week. Without the secret, the code cannot be turned back into an address — not by an attacker, not by a provider, not by us.
We would rather name this than hide behind a slogan. It is an identifier, and it lasts until midnight UTC. What it is not is a fingerprint that survives the day, or a cookie that survives the visit.
Cookies
The tracking script sets none, which is why Shoal asks nobody for cookie consent on your site. The dashboard uses a single first-party session cookie from Supabase, and only once you are signed in; it is what keeps you logged in and it is removed when you sign out.
In the UK and EU, first-party analytics that sets no cookies and stores no identifiers generally sits outside the consent requirement — but that judgement belongs to whoever runs the site, and to their jurisdiction. Shoal does not claim to make that decision for you.
Who is responsible for what
For the visits recorded on your site, you are the controller and Shoal is the processor: the data is yours, collected on your instruction, used only to show you numbers. For your account and billing details, Shoal is the controller.
If someone wants to know what a site recorded about them, they should ask that site's owner. We can help a site owner answer, but we cannot identify an individual visitor for anyone, including ourselves.
Who else is involved
Three services, none of which buys or sells data.
Supabase
Database and sign-in. Holds the tables described above, in the EU (Ireland).
Netlify
Hosting and edge network. Terminates the request and adds the country code header Shoal reads.
Stripe
Payments and invoices, only if you subscribe. Stripe is the merchant of record for card processing and holds the card details.
Deleting your data
Delete a site and its visits go with it. Delete your account from Settings and the account, its sites, its visits and its agent keys are removed immediately — no email and no waiting period.
If you subscribe, cancelling through the billing portal stops the next payment and ends Pro at the end of the period you already paid for. Shoal keeps the billing record itself for as long as tax rules require, but not your card.
Your rights
Under the UK GDPR you can ask what we hold about you, ask for a copy, have it corrected, delete it, or object to how it is used. Most of that is already a button: the agent rundown gives you your numbers as plain text, and deleting the account is self-serve. For anything else, email us and a person will answer.
Contact
Shoal is run by Coral Orbit Studio in the United Kingdom. Questions about this policy, or a request about your data? Email contact@coralorbit.studio, or delete the account yourself in Settings.
If this policy changes in a way that affects what is stored or how long it lasts, the date above changes with it, and subscribers are told by email rather than left to notice.