Sign-in
Four ways in, no social logins
Sign in with a passkey, a one-time link or code sent to your email, or an email and password. Google and GitHub sign-in are switched off.
Security
How ClickClacks protects your data
What we do to keep your account, your organization and the people you measure safe. Everything on this page describes how the product works today.
01 · Infrastructure
Runs on Cloudflare, end to end.
The application, its database, event collection and email all run on Cloudflare's platform. There are no servers of our own to maintain.
Hosting
Cloudflare
- Application
- Cloudflare Workersapp.clickclacks.io
- Accounts and settings
- Cloudflare D1SQL database
- Events and heatmaps
- Pipelines, R2, Durable ObjectsCloudflare storage
- Cloudflare Emailfrom clickclacks.io
- Bot protection
- Cloudflare Turnstileon sign-in
02 · Your account
Sign-in that doesn't lean on one password.
Verification
Two-factor and re-checks
Turn on two-factor authentication for your account. Sensitive changes, such as turning two-factor off, removing a passkey, transferring ownership or deleting an organization, ask you to confirm it's you again first.
Sessions
Visible sessions, throttled attempts
See every device signed in to your account and sign any of them out. Sign-in attempts are rate-limited, and repeated attempts must pass a Cloudflare Turnstile challenge.
03 · Your organization
Access follows roles, and changes leave a record.
Roles
Owner, Admin, Member, or your own
Every organization starts with three protected roles. Owners can add custom roles with exactly the permissions a teammate needs.
- OwnerSettings, roles, members, developer keys, audit log
- AdminMembers and invitations, audit log
- MemberNo administrative permissions
Audit log
An audit log that can't be edited
Invitations, membership and role changes, organization settings, API keys and webhooks are recorded in an audit log that Owners and Admins can review. The database refuses edits to an entry once it's written.
Developers
Keys stored as fingerprints
API keys are shown once and stored only as a one-way hash. Webhook signing secrets are encrypted, and every webhook delivery is signed so you can verify it came from us.
04 · Your visitors
Private before it leaves the browser.
The ClickClacks tracker is built so that the most sensitive things never reach us in the first place. You don't have to configure any of this.
URL scrubbing
Secrets are stripped from every URL
Before a pageview is sent, the tracker removes query parameters that look like secrets from the page address and the referrer. Add data-query="off" to drop query strings entirely.
Visited /reset?token=9f2c…&email=ana@acme.com&ref=mail
Stored/reset?ref=mail
Parameters removed, in any letter case:
- code
- password
- passwd
- pwd
- auth
- authorization
- session
- sessionid
- sid
- sig
- signature
- otp
- apikey
- phone
- ssn
- card
- cvv
- …_token
- …_key
- …_secret
Names ending in token, key or secret are caught with or without a _ or - before them.
Heatmaps
Screenshots are masked before upload
Form fields, embedded frames, video and canvas are replaced with grey blocks, and so is anything you mark
data-cc-mask. Email addresses and digits in the remaining text become dots. The tracker never reads what people type into a form. Domains
Only on your domains
The tracker only runs on the domains in its
data-domains list, and we reject browser events sent from anywhere else. Identity
No cookies, no IP by default
IDs are random and kept in browser storage, not cookies. IP addresses aren't stored unless you turn that on for a source.
05 · Your data and you
Take your data with you, or tell us what we missed.
Export and delete
Your data stays yours
Export your account data or delete your account from your settings. Organizations can export their data too. Read the privacy policy for the details.
Disclosure
Report a vulnerability
If you think you've found a security issue in ClickClacks, please email us with the details before sharing it anywhere else.
Start hearing your clicks.
One script tag. Your first report in minutes.
4.3 KB · pageviews, clicks and scroll depth, automatically