1. Scope and operator
This Privacy Policy describes how pvuv.ai handles information when you use our website, sign in to the console, or use our website analytics and traffic-quality features. The operator of this service is pvuv.ai. Independently hosted copies of the software are operated by their own deployers and are subject to those operators’ notices.
If you visit a website that uses pvuv.ai, that website’s operator decides whether and how to enable analytics, which events to submit, and what notices or consent are required. Please also read that website’s privacy policy.
2. Sign-in and account information
When you choose Google sign-in, we request basic identity permissions (openid, email and profile). We receive your Google account identifier, email address, email-verification status and profile name. We use the stable account identifier to create your own account, verify sign-in and keep your sites separate from other users. We store a derived account identifier, your verified email address, a display name, account creation information and preferences. Your verified email and display name are refreshed when you sign in again. If no profile name is available, your verified email may be used as your display name.
We do not request access to Gmail messages, Google Drive files, contacts or calendars. Google access tokens are used on the server to complete sign-in; they are not stored in the account database or exposed to the browser, and we do not retain Google refresh tokens. Google login information is not used for advertising, sold, or used to train general-purpose AI models.
Other available sign-in providers, such as Web.Cafe or GitHub, provide identity information for their respective sign-in flows. Accounts from different providers are not automatically merged merely because an email address matches. Provider services also apply their own privacy policies.
3. Website analytics and traffic-quality data
Depending on the features enabled by a website operator, analytics events can include page URLs and paths, referrers, campaign and advertising click parameters, event times, visitor and session identifiers, browser and operating-system information, device type, screen size, language, approximate location derived from network information, and network characteristics.
We may process engagement and performance signals such as visit duration, scrolling, interaction indicators, summarized pointer behavior, page errors and performance measurements. Traffic-quality checks can include automation indicators, rendering or device signals, and hashed fingerprint information. These identifiers and signals are pseudonymous, not a guarantee of anonymity.
The collection service receives an IP address to handle the request. Analytics records use keyed hashes of IP addresses and network segments rather than a dedicated plaintext IP field. Hosting and security infrastructure may separately process IP addresses and request logs. URLs, referrers and custom event properties can contain personal information supplied by a website; operators must avoid sending secrets, sensitive data or unnecessary personal information.
If a website uses identification or custom-event features, it may submit its own user identifier, event properties, transaction amounts or currency. That identifier is supplied by the website and is distinct from the website owner’s pvuv.ai login.
4. Cookies and browser storage
The console uses a signed session cookie to keep you signed in and short-lived cookies to protect the sign-in flow. A console session lasts up to seven days and is renewed while the authenticated console is used. Temporary sign-in state lasts about ten minutes. Page language follows the URL; short-lived signed sign-in state preserves the selected language during authorization.
On websites using the analytics script, first-party cookies can maintain visitor identity, sessions, first-touch attribution, a website-supplied user identifier and traffic-quality state. The visitor cookie has a lifetime of approximately thirteen months and may be refreshed on visits. A visitor identifier may also be stored in local storage, which has no automatic expiry set by this script.
You can clear cookies and local storage using your browser settings; clearing only cookies may leave the visitor identifier in local storage. Blocking storage or the script can affect sign-in or analytics. A website operator is responsible for controlling when analytics loads and obtaining any required consent.
5. Purposes and access
We use information to authenticate accounts, deliver analytics and reports, attribute traffic, identify suspected automation or invalid traffic, support configured ad-protection features, maintain reliability and investigate abuse or errors. Site owners can access the data associated with their own sites. Administrative functions are separately authorized; an administrator role does not by itself grant another user’s site access through the console.
Authorized service operators may need operational access to infrastructure and stored information for maintenance, security or support. Access controls and hashing reduce risks but cannot eliminate all risks.
6. Service providers, optional AI and public sharing
Cloud hosting, database and security providers process information as needed to operate the service. This deployment uses Cloudflare infrastructure and a hosted PostgreSQL database. Sign-in providers process authentication requests. These providers may operate in countries other than your own; this policy does not promise storage in a particular jurisdiction.
If an authorized administrator enables and requests an AI report, site statistics and report context, including page or source labels and anomaly summaries, may be sent to the configured AI provider. Google sign-in tokens and account profiles are not included in those report inputs. This feature is optional and the chosen provider’s terms and privacy practices also apply.
If you enable public sharing for a site, anyone with its share link may view the statistics made available through that feature. You can disable sharing in the console. Information may also be disclosed where required by law or necessary to investigate abuse or protect the service and its users.
7. Retention and your choices
Account information is retained to operate your account and meet legitimate security or legal needs. Analytics retention depends on service settings and maintenance; different event categories and aggregated statistics may have different retention periods. We do not currently promise a uniform automatic deletion deadline. Browser-cookie expiry does not delete server-side records.
You can sign out, revoke personal API tokens, disable public sharing and remove the analytics script from a website you control. You can also remove the Google connection in your Google Account settings. Disconnecting Google prevents further authorized access through that connection but does not itself delete existing pvuv.ai records or immediately sign out an existing pvuv.ai session.
You may request access, correction or deletion of information associated with your account, subject to identity verification and applicable requirements. If you are a visitor to a measured website, contact that website’s operator first so they can identify the relevant records and handle the request. Records may need to be retained for security, dispute resolution or legal obligations.
8. Updates and contact
The operator is pvuv.ai. General questions can be raised through the project feedback page. That page is public: do not post passwords, tokens, personal information or visitor records. For a private account or data request, ask to arrange a private contact channel without posting the underlying information.
We may update this policy as the service changes and will show the revised date on this page. Where required, we will provide additional notice or seek consent before using information for a materially different purpose.