---
title: Privacy and data handling
description: What Dashies stores, how analytics work for you and for people who open your dashboards, and what deletion actually removes.
updated: 2026-08-05
---

The [privacy policy](https://dashies.xyz/privacy) is the governing document. This
page explains the parts with a technical shape, so that the policy does not have
to and so that the two cannot drift apart by both saying it.

## What Dashies stores about you

Your account details, and the dashboards you publish.

The dashboards are the interesting half, because a Dashies dashboard is a
**materialized artifact**: the numbers are computed once and stored as static
bytes rather than re-queried per view. So what we hold is not only metadata about
your dashboards, it includes the aggregated results of the queries behind them.
The reasoning, and what that means for how you should write a cube, is in
[the security model](/trust#dashies-holds-a-copy-of-your-numbers).

Alongside them we keep the operational records that make the product work:
version history, refresh run outcomes, and the administrative audit trail. Those
are covered under [retention](#retention) below.

The policy states plainly that we do not sell your data, do not share it with
third parties, and **do not use it to train AI models**. The contents of your
dashboards stay yours.

## Analytics, and the people who open your dashboards

Dashies runs **first-party** analytics: pageviews, clicks, and coarse signals
like device type, browser, and approximate location. There are no third-party
trackers and no cross-site tracking.

Two properties matter more than the list:

- **Approximate location is derived from the IP address on our own server, and
  the raw IP is never stored.** What is kept is a pseudonymous identifier that
  **rotates every day**, so there is no durable per-person identifier to
  accumulate against.
- **A Global Privacy Control or Do Not Track signal is honored**, on the app and
  on shared dashboards alike, as is declining the in-app consent banner. When any
  of those is present, the pseudonymous analytics event is not emitted: no
  visitor identifier, no device, no location.

  Be precise about what that leaves. **An aggregate view counter still
  increments.** It records that a dashboard was opened, and nothing about who
  opened it, so there is no per-visitor identifier to suppress. If your
  requirement is "no identifiers", that is met. If it is "no signal of any kind
  reaches the server", it is not, and a count of one is still a count.

Inside the app, consent is asked for on a first visit and can be declined.

**Views of a dashboard you shared are logged the same way**, with the same
pseudonymous, rotating identifier, and honoring the same signals. This is the
part worth knowing if you send a dashboard link outside your company: the people
who open it are **counted, not identified**. A visitor signalling a privacy
preference drops out of the identified half entirely, and still lands in the
count.

The consequence for you as an author: **Dashies does not give you per-viewer
analytics on a shared dashboard**, and that is a design decision rather than a
missing feature. There is no viewer list, and there is no way to find out who
opened a link.

## Retention

Dashies deletes very little on a timer. Two things are worth knowing.

**Version history is capped.** The most recent 20 unlabelled autosaves are kept
per dashboard, and older ones are pruned. A labelled version is never pruned. See
[Version history](/guides/version-history).

**Audit and activity records have no expiry.** The workspace audit log, your
dashboard activity feed, and refresh run history are kept for the life of the
thing they belong to. There is no retention window to configure and no automatic
purge.

That makes deletion, not time, the thing that removes them.

## What deletion removes

**Deleting a workspace** removes its audit log with it, permanently and with no
export. If you need the record of a workspace you are winding down, read it
first. See [Audit log](/admin/audit-log#retention).

**Deleting a dashboard** is a soft delete: the activity feed records the deletion
as a final entry, and further changes to it stop being recorded.

**Deleting your account** removes the operational records tied to you personally,
including your dashboard activity feed, your refresh alert history, and the
record of your AI tool's connections.

One deliberate exception: entries in a **workspace's** audit log survive, with
the names they were written with. A workspace's history of who was invited,
promoted, and removed does not develop gaps when someone leaves, which is the
behaviour an audit trail has to have to be worth keeping.

:::note{title="Account deletion is by request"}
There is **no self-serve delete-account button** in the app today. Deletion is
handled by asking, using the contact address in the
[privacy policy](https://dashies.xyz/privacy).
:::

## Where to go next

- [The security model](/trust) - what Dashies can and cannot see, and who can
  read a published dashboard.
- [Warehouse credentials](/trust/warehouse-credentials) - handled differently
  from everything on this page.
- [Dashboard isolation](/trust/dashboard-isolation) - what a published dashboard
  can and cannot reach.