Security & Privacy

Docsbook gives documentation owners detailed analytics — what visitors search for, which pages they read, and where they get stuck. Detailed visibility and visitor privacy are not in tension: the analytics are built so no individual visitor is ever personally identifiable, and no data leaks between workspaces. This page explains how, in plain language.

No PII in visitor analytics

Docsbooknever stores a visitor's raw IP address, and no response from our analytics API ever exposes one. Instead, each visitor is assigned a pseudonymous identifier derived from their network address and the specific workspace they're browsing. That identifier lets us tell "the same visitor came back" apart from "this is a brand-new visitor" within one workspace — without ever recording who that visitor actually is.

Because the identifier is derived per-workspace, it does not carry over: the same person reading docs on two different Docsbookcustomers' sites gets two unrelated identifiers. There is no global visitor profile, and cross-workspace tracking is not architecturally possible — not just disabled by policy.

Cookieless analytics by design

Docsbook does not set tracking cookies to observe documentation visitors. Cookies in our stack exist only to keep you signed in to your own account, and — for workspaces with password or SSO protection enabled — to remember that a visitor has already passed that gate. Neither of these is used to build an analytics profile of who is reading your docs. Visitor analytics work the same whether or not a visitor accepts, blocks, or never sees a cookie prompt.

Data processors

We keep our subprocessor list short and rely on established infrastructure providers rather than building our own:

• Vercel — application hosting and edge network
• Neon (Postgres) — primary database for accounts and workspace data
• Axiom — event storage and querying that powers the analytics dashboard
• Paddle — payment processing and billing; we never see or store your card details
• Resend — transactional email delivery (sign-in codes, notifications)

Each processor only receives the data required to perform its function, and each is bound by its own security and privacy commitments.

Data retention

Analytics events are retained for as long as the workspace they belong to exists, so you can look back over your documentation's history. We do not currently publish a fixed retention window shorter than the lifetime of the workspace; if you need a specific data-deletion arrangement, contact us and we will work it out with you.

For the full legal terms covering data collection and use, see our Privacy Policy and Terms of Service.