storylight

Privacy notice

Last updated: 2026-10-16 · Closed-alpha version.

What this is

Storylight is a customer-journey analytics platform in closed alpha. Sites that embed the Storylight SDK collect technical signals from their visitors to enable analytics and cross-site identity resolution.

What gets collected

  • First-party cookie (xtra_tid): a random UUID identifying the browser. Set on the embedding site's domain, not Storylight's.
  • Page-view events: URL, referrer, click IDs (fbclid, gclid), user-agent string, IP address (request-time only, not stored separately from the event).
  • Browser fingerprint: screen, timezone, canvas/WebGL/audio hashes, installed fonts. Used to recognize the same browser across visits and across sites in the network.
  • Engagement signals: per-page dwell time, scroll depth, active-tab time, exit action (clicked a link, closed the tab, etc.). Standard analytics — not biometric.
  • Behavioral signals: only if a site has opted in via data-behavioral="on". Mouse motion and keystroke timing patterns, aggregated per ~30-second window.
  • Hashed identity (when a tenant pushes it): if a tenant site's own login system calls xtra.identify(...) after their user signs in, we store the SHA-256 hash of the user's trimmed lowercased email (the same normalization Meta CAPI and Google Enhanced Conversions use). The plaintext email is hashed in the browser and never reaches our servers. Optionally a tenant-scoped external_id (the tenant's internal user identifier).

Cross-site recognition

The product's value is in recognizing the same end-user across multiple participating sites using fingerprint + engagement signals — third-party cookies are not used. When a cross-site match occurs, both sites' dashboards may show an aggregate "also seen on N other sites" indicator. The other sites' identity is never revealed.

Waitlist

If you join the waitlist on this site, we collect your email address. We use it only to contact you about access to Storylight: an invitation when an alpha spot opens, and questions about your site before we set it up. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract).

The form sends your sign-up to a serverless function run by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA, which also hosts this website, as our processor under Art. 28 GDPR, with a data processing agreement in place. The function runs in the USA, stores nothing, and passes the sign-up straight on to HubSpot. Netlify, Inc. is certified under the EU-U.S. Data Privacy Framework, and its data processing agreement also includes the Standard Contractual Clauses (EU) 2021/914.

Sign-ups are stored in our CRM, HubSpot, operated by HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland, as our processor under Art. 28 GDPR, with a data processing agreement in place. Our HubSpot account is hosted in the EU. This site loads nothing from HubSpot and sets no HubSpot cookies. HubSpot's parent company, HubSpot, Inc. (USA), and its sub-processors may access the data, for example for support. HubSpot, Inc. is certified under the EU-U.S. Data Privacy Framework, and HubSpot's data processing agreement also includes the Standard Contractual Clauses (EU) 2021/914.

We delete your entry when you ask us to, and otherwise 12 months after you signed up if we haven't invited you by then.

Where data lives

A SQLite database on a single VPS operated by Storylight. Backed up nightly. No third-party data processors. No cloud database. No data sold or shared with advertisers. Waitlist sign-ups are the exception: they live in HubSpot (see Waitlist above).

Controller

The controller for the processing described here, as defined in Art. 4(7) GDPR, is:

TwoFlow Thonig Ohle GbR
Knud-Rasmussen-Str. 11
18106 Rostock, Germany
contact@twoflow.de

Full company details are in the legal notice.

Contact / deletion requests

Closed-alpha product. Write to contact@twoflow.de for data deletion or questions. A self-service deletion endpoint will land when alpha ends.

Jurisdiction

Sites embedding the SDK are responsible for their own GDPR/CCPA compliance regarding their visitors.