How we handle privacy and analytics

Vercel Analytics counts page views by hashing each request's IP address + user agent + page path into a daily anonymous bucket. It does NOT drop a cookie, fingerprint the browser, or correlate across days. Each day's bucket is independent.

The dashboard surfaces aggregate counts per page and per country — nothing more. We never see an individual user's path through the site.

A deliberately short list — these are the patterns we have actively chosen against:

• ▸No Google Analytics. No Plausible script. No Fathom. No Mixpanel. No Segment.
• ▸No third-party advertising pixels (no Meta Pixel, no LinkedIn Insight, no X Pixel).
• ▸No session replay (no Hotjar, no FullStory, no LogRocket).
• ▸No cookies of any kind on hundo-hunter.com — open DevTools and verify.
• ▸No localStorage tracking beyond functional preferences (theme, language).
• ▸No A/B test framework that fingerprints visitors into buckets.

If a page surfaces an email opt-in (rare — currently only the monthly events recap), the opt-in is double-confirmed: you enter your email, we send a confirmation link, you click. We store only the email and a confirmation timestamp.

Lists are kept in a single Postgres table, never exported to any third-party mailer. We send via a single transactional provider (Postmark) on a dedicated subdomain.

unsubscribe_url = `${BASE}/u/${hmac_sha256(email, UNSUB_SECRET)}`

On click:
  candidate_emails = SELECT email FROM subscribers
  for each email:
    if hmac_sha256(email, UNSUB_SECRET) == token:
      DELETE FROM subscribers WHERE email = $1
      return 200 "You are unsubscribed."

The iOS app is the same posture. No analytics SDK is linked into the binary — no Firebase, no Amplitude, no Mixpanel. Crash reports go through Apple's built-in crash reporting only (opt-in at the OS level).

Captured Pokémon data stays on-device in a local SQLite database. It never leaves the phone except via the user's own iCloud backup (Apple-encrypted, opaque to us).