Privacy & GDPR
This page describes what data Nonaki collects, how long it is kept, and what tools are available to manage it.
What Data Is Collected
Clicks
When a visitor follows one of your redirect links, Nonaki records:
- Timestamp
- Device type, browser, and operating system (derived from User-Agent)
- Country (from CDN headers if available, otherwise from GeoIP if configured)
- Referrer URL
- A hashed version of the visitor's IP address (see below)
- Whether the visitor was identified as a bot
Impressions
When a page on your site containing a Nonaki link is viewed, Nonaki records:
- Timestamp
- Device type, browser, and operating system
- Country (from CDN headers if available, otherwise from GeoIP if configured)
- The URL of the page where the link appeared
- A hashed version of the visitor's IP address
IP Address Handling
Raw IP addresses are stored temporarily in an internal processing queue and are deleted within approximately 5 minutes after the background processor runs.
For long-term storage, the IP address is converted to a one-way hash (SHA-256 with a site-specific salt). This hash cannot be reversed back to the original IP address. It is used only to deduplicate impressions within short time windows — it cannot be used to identify a visitor.
What Is Not Stored
- Full IP addresses in analytics (only hashed)
- Cookies or browser fingerprints
Your Responsibilities as a Site Owner
All data described on this page is collected by you, on your website, from your visitors. AffKraft does not receive, access, or store any of it — the plugin runs entirely within your WordPress installation.
As the site owner, you are the data controller under GDPR and similar regulations. You should:
- Disclose analytics tracking in your privacy policy
- Ensure your use of visitor data complies with the laws applicable to your site and audience
Clearing Analytics Data
The Clear All Analytics button in Nonaki → Settings → Analytics Data permanently deletes all recorded clicks, impressions, and queue entries. This can be used to respond to a GDPR erasure request or to start fresh.
Individual link analytics are also deleted when a link is permanently force-deleted from the Trash.