Privacy Policy

1. Our role

For customer accounts, we decide how information is used and are responsible for it (the “controller”).

For website visitors, the customer who installed Routely on their website decides what to test and measure, and we process visitor information on their behalf and under their instructions (we are their “processor”). If you are a visitor and have a question about a website’s use of Routely, contact that website’s owner; we will help them respond.

2. Information we collect from customers

Account information

• Your name and email address.
• Your password, if you sign up with one. We store only a salted scrypt hash, never the password itself.
• If you sign in with Google: your Google account’s name, email address and profile picture, and whether Google has verified the address.
• Your notification preferences and the workspace you last used.

Sign-in sessions

For each signed-in device we keep the browser and operating system (from the browser’s user agent), an approximate city and country derived from the request’s IP address by our hosting provider, and when the session started and was last used. We do not store the IP address itself. This powers “Where you’re signed in” in Settings and the email we send when you sign in from a new device.

Workspace content

• Projects: names and website domains.
• Experiments: names, page URLs, variants and the visual changes you make, traffic settings, goals and an activity log of who did what.
• Team: the people in your workspace, their roles, and the email addresses of people you invite.
• Installation checks: when you ask us to verify a page, we fetch that public page and record whether the snippet was found. To show each project's icon, we also fetch its public homepage and the favicon it declares.

Google Sheets integration (optional)

If an admin connects Google Sheets, we store the connecting Google account’s email address, an OAuth refresh token (encrypted at rest with AES-256-GCM), and the ID of each spreadsheet a project exports to. See Google user data.

3. Information collected about website visitors

When a customer installs the Routely snippet, it collects only what is needed to run and measure their experiments:

• A random visitor ID generated in the browser. It is not derived from any personal detail and is used only on that website.
• Which experiments the visitor was included in and which version they were shown.
• Pages viewed on that website (the page address, with advertising parameters such as utm_source and gclid removed), when, and how long the page was visible in the browser.
• Whether the visitor reached the goal page the customer chose (a conversion).
• A daily count of distinct visitors per website and per page, used for traffic figures.

The browser’s user agent is read to filter out bots and to tell desktop, tablet and mobile apart for device targeting; it is not stored. The IP address is not stored. Routely does not track visitors across different websites, does not build advertising profiles, does not use device fingerprinting, and does not collect names, email addresses or form contents from visitors.

Customers are responsible for telling their visitors about Routely and for obtaining any consent their local law requires before the snippet runs (for example, through their cookie banner).

4. How we use information

• To provide Routely: signing you in, running experiments, calculating results and showing them to your team.
• To keep accounts secure: rate-limiting sign-in attempts, listing and revoking sessions, and alerting you to sign-ins from new devices.
• To send email you need — verification, password reset, team invitations — and the notifications you have chosen to receive, such as “a result is ready” or “tracking stopped”. You can turn notifications off in Settings.
• To export your project’s figures to Google Sheets, if you set that up.
• To diagnose problems and keep the service working.

5. What we do not do

We do not sell personal information, share it for advertising, or use it to train machine-learning models. We do not show ads.

6. Google user data

Google sign-in asks Google for your name, email address and profile picture (the openid, email and profile scopes), used only to create and sign in to your Routely account.

The Google Sheets integration asks for openid, userinfo.email and drive.file. The drive.file scope gives Routely access only to spreadsheets Routely creates or that you choose in Google’s file picker — not to the rest of your Google Drive. Routely uses it only to create those spreadsheets and to write your project’s daily figures to a tab named “Routely” in them. Disconnecting the integration in Routely stops all access, and you can also revoke it at any time from your Google Account’s security settings.

Routely’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not let people read it except where you ask us to (for example, for support), for security, or where the law requires, and do not use it to train AI or machine-learning models.

7. Who we share information with

We use these service providers to run Routely:

Besides them, information is shared only:

• Within your workspace: its members see the workspace’s projects, experiments, results and team list, according to their role.
• Through share links: anyone with an experiment’s share link can view that experiment’s results until the link is turned off.
• When the law requires it, or to protect the rights, safety or property of our users or others.
• If Routely is sold or merged, with the new owner, who would remain bound by this policy.

8. Where information is stored

Routely’s database is in Singapore, and pages are delivered through servers around the world. Wherever information is handled, we protect it as this policy describes.

9. How long we keep information

• Account information: for as long as your account exists.
• Sign-in sessions: until you sign out, revoke them, reset your password, or 30 days without renewal.
• Password-reset links expire after 1 hour, email-verification codes and links after 24 hours, team invitations after 7 days.
• Daily visitor counts: 400 days, then deleted automatically.
• Experiments and their visitor data: until the customer deletes the experiment or its project, which deletes everything beneath it.
• Google Sheets connection: until it is disconnected.

10. Cookies and browser storage

On Routely itself

We use only cookies that are needed for Routely to work:

Sign-in with Google briefly sets further Auth.js cookies to secure the round trip to Google. We use no analytics or advertising cookies.

On customers’ websites

The snippet stores the random visitor ID in a first-party cookie, routely_vid (1 year), and in the browser’s local storage, along with keys beginning routely_ that remember the visitor’s experiment versions, so a visitor sees the same version on every visit and is not counted twice.

11. Security

All traffic is encrypted in transit (HTTPS). Passwords are hashed with scrypt, and Google refresh tokens are encrypted at rest. Sessions are stored on the server, so signing out or revoking a session ends it immediately. Every request is checked against the person’s role in the workspace. No system is perfectly secure; if we learn of a breach that affects your information, we will tell you without undue delay.

12. Your choices and rights

You can update your name, email address and password, sign out other devices and change notifications in Settings.

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, and to object to or restrict how we use it. To make a request — including deleting your account, which is not yet available in Settings — contact us at the support address on the Routely sign-in page. We will respond within 30 days. You may also complain to your local data protection authority.

Website visitors can clear the routely_vid cookie and the routely_ storage keys in their browser at any time, which resets their Routely identity on that website.

13. Children

Routely is a business tool and is not directed to children under 16. We do not knowingly collect personal information from them.

14. Changes to this policy

We will update this page when our practices change and revise the date at the top. If a change is significant, we will also tell signed-up customers by email before it takes effect.

15. Contact

Questions about this policy or your information: Right Left Agency, at the support address on the Routely sign-in page.