Privacy and cookies
Headra counts page views without cookies and without storing anything about the people reading your websites, so it doesn't need a cookie banner in any territory. This page sets out exactly what is and isn't kept, for your own privacy notice.
Website visitors
When someone reads a page on a website that uses Headra, their browser asks the Headra API for the content and, if the website counts views, sends a small "viewed" message (see Connecting a website).
| What | Stored? |
|---|---|
| Page views | Only a total per item per day (for example "Spring menu: 42 views on 3 May"). Nothing that identifies a visitor, and no separate record per view. Totals are deleted after about 13 months. |
| Cookies, local storage, device IDs | None. Headra never sets or reads anything on a visitor's device. |
| IP address | Used for a few seconds to stop one address flooding the API, and kept only as a one-way scrambled code (a keyed hash) for that minute, then deleted automatically. The address itself is never written down. |
| Browser (user agent) | Checked so search engine robots aren't counted as views, then discarded. |
| Referrer, location, screen size, time on page | Not collected. |
Like any web server, the servers Headra runs on keep standard access logs (IP address, time and address requested) for security and troubleshooting. These are kept for a limited time and aren't used for analytics.
Do I need a cookie banner?
Not for Headra, wherever your visitors are. Cookie and tracking rules apply when a website stores or reads information on the visitor's device, or follows people across sites. Headra does neither, and its view counts don't identify anyone.
Your website may still need a banner or an opt-out for other things it uses, such as Google Analytics, advertising, social media widgets or embedded videos. The starter kit remembers the visitor's light or dark theme choice in their browser; that's a setting they chose themselves, which is generally treated as exempt.
Privacy laws around the world
Most privacy laws are about personal information: anything that identifies a person, directly or indirectly. Headra keeps none about your visitors, so the same answer holds in every territory. The main laws, and where Headra stands:
| Where | Main rules | Headra |
|---|---|---|
| UK and EU (and EEA) | UK GDPR and the Data Protection Act 2018, the EU GDPR; PECR and the ePrivacy Directive for cookies | No consent needed: nothing is stored on the device and visitors aren't identified. Brief IP use for security is a legitimate interest. |
| Switzerland | Federal Act on Data Protection (revised FADP) | As for the UK and EU. Mention Headra in your privacy notice. |
| United States | California (CCPA as amended by the CPRA) and the other state privacy laws (Virginia, Colorado, Connecticut, Texas and more) | Headra doesn't sell or share personal information, doesn't do cross-site advertising or profiling, and acts as your service provider. There's nothing to opt out of, so a "Do Not Sell or Share" link and Global Privacy Control signals aren't needed for Headra. |
| Canada | PIPEDA; Quebec's Law 25 | Law 25 requires tracking and profiling tools to be off by default. Headra has none, so there's nothing to switch off. |
| Brazil | LGPD | No personal data about visitors is kept; brief IP use for security is a legitimate interest. |
| Australia and New Zealand | Privacy Act 1988 (Australian Privacy Principles); Privacy Act 2020 | Headra doesn't collect personal information about visitors, so there's nothing to disclose beyond the note below. |
| Elsewhere | For example Japan (APPI), South Africa (POPIA), India (DPDP Act), Singapore (PDPA) | The same: no visitor personal data, no cookies, no tracking across sites. |
If your website collects personal information itself, for example through forms, accounts or other services, those laws apply to that in the usual way.
People who use Headra
For you and your colleagues (the people who sign in), Headra keeps what it needs to run the account and keep it secure:
- Your name, email address and password (the password is stored only as a secure hash), plus your two-factor settings if you turn them on.
- Sign-in sessions: the IP address and browser of each signed-in session, deleted when the session ends or expires.
- Activity log: who changed what, when, and from which IP address. It's how you answer "who changed this?" (see Analytics and activity). IP addresses, and the email address typed into a failed sign-in, are removed after 90 days; entries are deleted after 2 years. Content revisions are kept separately, so an item's history isn't affected.
- Bug reports and ideas (if you have access): what you write, the admin page you were on, your browser and the Headra version, kept until the report is deleted. Other users see your reports under a random nickname, not your name.
- Password reset requests: the IP address they came from, deleted when the link expires an hour later.
The Headra admin sets only the cookies needed to sign in securely (your session, and a security token on the sign-in page). They aren't used for tracking.
Your privacy notice
If your website shows content from Headra, your privacy notice can say something like:
"Our content is served by Headra, a hosted content management system. To deliver pages it briefly processes your IP address for security, without storing it. It counts page views as anonymous daily totals and doesn't use cookies or track you across sites."
You decide what your website collects, and Headra handles data only on your behalf. Under the GDPR and similar laws (LGPD, POPIA, the revised FADP) that makes you the controller and Headra the processor; under US state laws such as the CCPA, you're the business and Headra the service provider. Ask us if you need a data processing agreement.