Last updated: 2026-05-13
Who we are
fleets.run ("fleets", "we") is operated by Yoann Defay (contact@yoanndefay.com). We provide a multi-site analytics terminal for operators of websites.
What we collect
From you (account holders)
- Email address (via Clerk authentication)
- Workspace name and site metadata you enter (domain, GA4 property ID, etc.)
- API tokens, encrypted with AES-256-GCM at rest
- Stripe billing identifiers if you upgrade to PRO
Via connected analytics sources
When you connect Google Analytics, Search Console, or Cloudflare, fleets reads aggregated traffic data for the properties you authorize. We do not store raw event-level GA4/GSC data; we cache aggregates for up to 10 minutes (public boards) or 1 hour (private dashboards) to stay within upstream API quotas.
Via the fleets pixel (PRO, optional)
If a customer installs the fleets pixel on their site, we collect signals from each page view:
- IP address, ASN, country (Cloudflare edge)
- TLS fingerprint (JA3 / JA4 via Cloudflare bot management headers)
- HTTP headers: User-Agent, Accept-Language, Referer
- Page path
- Browser challenge results (canvas hash, WebGL renderer hash,
navigator.webdriverflag, hardware concurrency, paint timing) - Classification verdict (
human/suspicious/bot)
We do not drop cookies and do not read existing cookies via the pixel. We treat the data as legitimate-interest analytics under GDPR; the customer who installs the pixel is responsible for surfacing its presence to their own visitors.
Retention
| data | retention | |---|---| | Account email, workspace, site metadata | until account deletion | | Encrypted connector tokens (CF, GSC) | until you disconnect | | Cached GA4/GSC/CF aggregates | rolling 24 h | | Pixel raw events | 90 days | | Pixel hourly aggregates (pixel_aggregates) | 18 months | | Stripe records | per Stripe retention policy | | Audit log (events) | 90 days |
Where data lives
- Application + SQLite database: Google Cloud Platform, region
us-central1 - Database backups (Litestream): GCS bucket, same region
- Pixel edge collection: Cloudflare global edge
Your rights
- Access — request a copy of the data we hold for you
- Deletion — request full account deletion
- Portability — request export in JSON
- Correction — fix any inaccurate data via the app UI
Email contact@yoanndefay.com for any of the above. We respond within 30 days.
Sub-processors
| processor | purpose | data | |---|---|---| | Clerk | authentication | email, name | | Cloudflare | DNS, pixel ingest, edge cache | IP / fingerprint signals | | Google Cloud | hosting, backups | all app data | | Stripe | payments | name, email, billing | | Cloudflare Email Worker | transactional + digest email | email, message content | | Anthropic | SEO advisor (PRO) | GSC query/page data, anonymous |
Changes
We will post an updated version of this policy on this URL and update the "Last updated" line. Material changes will be emailed to all account holders.