This isn’t legal advice. This page describes how PathClue is actually built and run. If the English and Chinese versions differ, the English version applies unless mandatory local law says otherwise.
1. Who we are, and which role we play when
PathClue is run by TapCub (“we”, “us” in this policy), including this website, the console you sign in to and the PathClue analytics service. For privacy questions, write to hello@tapcub.com.
- We are the controller for people who sign up, members who are invited, people who contact us and people who browse this website. We decide why and how that data is processed.
- We are a processor for visitors to the websites, apps and mini programs our customers measure (“Visitor Data”). There the customer is the controller, and we process data only on the customer’s instructions, under this policy and a data processing agreement available on request.
If you visit a site that uses PathClue and want to exercise your rights, please contact the people who run that site first; we help our customers respond within the legal deadline.
2. What we collect as controller
Account: email address, password hash, display name, optional profile picture, language and time-zone settings, multi-factor settings, and the time, IP address and user agent of each sign-in (kept for account security).
Billing: plan, order and invoice history, which payment provider you used (Stripe, PayPal, Alipay or WeChat Pay), the amount and the transaction reference; for card payments, also the card brand and last four digits that Stripe returns. We never see or keep full card numbers.
Support: what you send us by email or through the chat on this website, and the name and email address we need to reply.
Product usage: which console features you use, rolled up into counts that help us decide what to improve next. Neither this website nor the console runs third-party analytics or advertising pixels.
3. What we process for customers
Analytics data: for each pageview or event — the page address and referring page, UTM parameters and ad click IDs in the address, user agent, screen-size range, language, an approximate country or region derived from the IP address, custom events and their properties, and an anonymous visitor identifier. In the default anonymous mode our servers compute that identifier as a keyed hash of the site key, IP address, user agent and a salt only the server knows. The salt is kept for a while on each site so new and returning visitors can be told apart; when a customer chooses strict mode, it changes every day. The full IP address is used in memory at the moment of collection — to estimate the region, rate-limit and recognise bots — and is never written to the database.
Identity mode: a customer can turn on identity mode for a site to build user profiles that last across days. The script then stores a random first-party device identifier in the browser; in regions where the customer requires consent (by default the EEA and the UK), only after the visitor agrees through the customer’s banner. When a customer sends their own user ID or profile fields such as a name or email, we store them as instructed, with email addresses and phone numbers encrypted at rest. Customers can delete a person and everything linked to them from the console.
Heatmaps and session replay: once a customer turns them on, they record click and scroll positions and page structure. By default, anything typed into form fields is masked before it leaves the browser.
4. How counting without cookies works
In the default mode the analytics script writes no cookies and doesn’t use localStorage, sessionStorage or IndexedDB. Deciding whether two requests come from the same visitor happens entirely on the server, using information the browser sends anyway. Nothing is stored on the visitor’s device, which is why many sites don’t need a separate consent banner for analytics.
When a browser sends Do Not Track or Global Privacy Control, the analytics script doesn’t run by default; if a request still arrives some other way, we handle it at the most anonymous level and compute or store no visitor identifier. Counting without cookies has a cost, and we say so in the product: unique visitors across days are an estimate and won’t match tools that use persistent identifiers, and in strict mode visitors are de-duplicated within a single day only.
5. This website
pathclue.com sets no cookies. It stores two settings in your browser, and only after you act: the language you picked, and whether you closed the announcement bar. The site is measured with our own analytics script in its default cookieless mode. If you open the chat window in the corner, the chat widget stores one session token so the conversation survives a page reload; until you open it, nothing is stored.
6. Why we process data, and on what basis
- To perform our contract with you: running your account, billing, support and the features you turn on.
- Legitimate interests: keeping the service secure (sign-in records, rate limiting, spotting abuse and bots), understanding overall usage, and dealing with legal claims.
- Legal obligations: tax and accounting records, and responding to lawful requests.
- Consent: optional product emails and anything else we explicitly ask you about; you can withdraw it at any time.
The legal basis for Visitor Data is for the customer to determine. Under China’s Personal Information Protection Law, the customer is the personal information handler and we are the party entrusted with processing.
7. How long we keep data
Analytics data follows the retention of the customer’s plan (6 months on Free, 12 months on Pro, 24 months on VIP 1, 24 months on VIP 2), or a shorter period the customer sets, and is then deleted automatically.
Account data is kept while the account exists and for 30 days after it is deleted. Billing records are kept for as long as tax law requires. Server and security logs are kept for up to 90 days. Backups rotate out within 35 days of data being deleted from production.
8. Who processes data for us
We don’t sell personal data and don’t share it with advertisers. We use the following kinds of service provider, each contractually bound to act only on our instructions:
- cloud servers, databases and object storage;
- content delivery for the analytics script and this website;
- payment providers: Stripe, PayPal, Alipay and WeChat Pay;
- transactional email for sign-in, alerts and invoices;
- AI model providers for insights and plain-language questions, contractually barred from training on the data;
- notification channels and ad platforms that you connect yourself.
The full list of providers is available on request. We give data to authorities only when the law requires it, and tell the affected customer unless the law prevents us.
9. Where data is stored
The analytics script comes from static.pathclue.com and data is sent to api.pathclue.com. Data is currently stored in the United States. When other regions open, hosts with a region suffix (for example api-eu.pathclue.com) will keep data in that region, chosen by the customer when creating a site. Where data has to leave the region it was collected in, we use recognised safeguards such as standard contractual clauses, and encrypt it in transit.
10. Your rights
Depending on where you live, you may have the right to see, correct, export or delete your personal data, or to restrict how we process it; to object; to withdraw consent; and to complain to a supervisory authority.
Account holders can do most of this in the console: edit their profile, export analytics data and delete the account. For anything else, write to hello@tapcub.com and we will reply within 30 days. Visitors to customer sites should contact the people who run that site; they can delete or export your data in the console.
11. How we protect data
Everything is encrypted in transit. Passwords are salted and stored as hashes, and every account can turn on multi-factor authentication. Access is granted by role and each customer’s data is kept separate; administrative actions are logged; only staff who genuinely need it can reach production systems. If personal data is breached, we notify affected customers without undue delay and, where the GDPR applies, within 72 hours of finding out.
12. Children
The service isn’t aimed at children under 16, and as controller we don’t knowingly collect their personal data. Customers whose sites are aimed at children are responsible for following the rules that apply, including getting parental consent where required.
13. Updates to this policy
We update this policy when the product or the law changes. We tell you about significant changes by email or in the console before they take effect; the date at the top of this page shows when it last changed.
14. Contact us
Write to hello@tapcub.com. If you aren’t satisfied with our reply, you can complain to the data protection authority in your country.