Website analytics privacy.

Updated October 31, 2026.

Malagon Systems uses a private, first-party analytics service to understand how its projects are visited. The owner can view successful page loads, approximate countries, public pages, referral domains, broad device and browser categories, and request response times.

Anonymous estimates

The service creates a daily identifier using a keyed hash of the network address and browser user agent. Identifiers are different for each project and reset each day. They estimate visits, not verified people. Shared networks may merge visitors and changing networks may split a visitor. No analytics cookies or browser fingerprinting scripts are used.

What is kept

The live analytics database retains summaries and anonymous events for 14 days. It does not retain raw network addresses, raw browser user agents, full referrer URLs, query strings, account names, email addresses, messages, or private page details. Only known public paths appear; other application paths are redacted. The owner-only dashboard requires authentication.

Local request events are processed on the server. Roll Call and Highlighter use existing server access logs read-only; those operational logs have their own retention and may include information required to operate and secure the applications. This analytics service does not add new raw-address log files.

Browser privacy preferences

On sites connected through the local event stream, a Do Not Track or Global Privacy Control signal prevents the creation of a visitor identifier. Aggregate page loads may still be counted. Existing Roll Call and Highlighter access logs do not include these signals, so the read-only analytics reader cannot apply those preferences retroactively.

Questions

Contact michael@roll-call.me about this analytics service. Each application’s own privacy information governs its accounts and other application data.