Privacy Policy
This Privacy Policy explains how TheNextLvl Productions collects, uses, and protects personal data when you use faststats.dev.
Last updated: 29 June 2026
1. Controller Information
TheNextLvl Productions
Sole proprietorship
Germany, Baden-Württemberg
Email: legal@faststats.dev
Further legal and contact information is available via the Imprint.
2. Scope of This Policy
This Privacy Policy applies to:
- The faststats.dev website
- The FastStats documentation website
- The logged-in application and dashboard
- Publicly accessible views of unrestricted applications
It does not apply to third-party websites or services linked from faststats.dev.
3. Data We Collect
When you create an account, we collect:
- Email address
- Username
- Name, avatar, organization memberships, and roles
- Password (stored only in hashed form)
- Two-factor authentication and passkey records, if enabled
- Session data such as session identifiers, IP address, user agent, and login timestamps for security and account management
We use FastStats to analyze usage of the Service. Through FastStats, we process:
- Device and browser information
- Page URLs, page titles, referrers, UTM parameters, and approximate country
- Usage events, feature usage, web vitals, and error reports
- Session recordings where enabled
- Identified user behavior linked to an account
Important clarifications:
- We do not use analytics data for advertising
- We do not collect advertising identifiers
- We do not sell or share data for advertising purposes
Customers and developers may submit analytics, events, error reports, session replay data, web vitals, feature flag evaluations, download statistics, imported analytics data, Search Console data, source maps, and LLM trace data. This may include identifiers, URLs, event properties, stack traces, console output, request metadata, prompts, outputs, and other content configured by the developer.
Developer-submitted content is managed and controlled by the developers themselves. While our Terms of Service remain fully applicable, the legal obligation for ensuring compliance with applicable data protection laws rests with the developer. FastStats will take action if it becomes aware of any violations.
5. Purposes and Legal Bases of Processing
We process personal data for the following purposes:
| Purpose | Legal Basis (GDPR) |
|---|---|
| Account creation and authentication | Art. 6(1)(b) GDPR (contract) |
| Providing and operating the Service | Art. 6(1)(b) GDPR |
| Analytics and product improvement | Art. 6(1)(a) GDPR (consent) where required, otherwise Art. 6(1)(f) GDPR (legitimate interest) |
| Processing customer-submitted analytics, replays, errors, web vitals, and LLM traces | Art. 6(1)(b) GDPR for our customer relationship; the customer is responsible for the lawful basis for personal data they submit about their users |
| Connected services such as GitHub, Google Search Console, download providers, and billing | Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR |
| Security and abuse prevention | Art. 6(1)(f) GDPR |
| Legal compliance | Art. 6(1)(c) GDPR |
6. Data Sharing and Sub-Processors
We do not sell personal data and do not share it for advertising purposes.
We use the following sub-processors to operate the Service:
- Railway (Amsterdam) – application hosting
- DigitalOcean (Frankfurt) – application hosting
- Netcup (Nürnberg) – database hosting
- Tinybird (Frankfurt) – managed Clickhouse database hosting
- PlanetScale (Frankfurt) – managed PostgreSQL database hosting
- Cloudflare – content delivery network and security, storing profile pictures
- Tigris (Frankfurt) – session replay object storage
- Resend – transactional email delivery
- Polar – subscription and billing management (receives username, email address, and aggregated usage counts such as number of events, errors, replays, or vitals; no actual analytics data is shared)
Most processing takes place within the European Union (Amsterdam region).
7. International Data Transfers
Data never leaves the European Union. Data is stored in Frankfurt and partially processed in Amsterdam.
8. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes described in this policy, including legal, accounting, or technical requirements.
You may delete your account at any time, which will result in the deletion of associated personal data unless retention is legally required.
9. User Rights
Under the GDPR, you have the right to:
- Access your personal data
- Request deletion of your personal data
- Restrict or object to processing
- Data portability
- Account data access and deletion can be managed directly in the account settings
- Username and email address can be corrected in the settings
- Additional requests may be submitted via legal@faststats.dev
You also have the right to lodge a complaint with a supervisory authority.
10. Security Measures
We implement appropriate technical and organizational measures to protect personal data, including:
- Encrypted password storage
- Access controls
- Secure infrastructure and hosting providers
No system can guarantee absolute security, but we take data protection seriously.
11. Children's Privacy
The Service is not specifically intended for children. We do not knowingly collect personal data from children. If you believe a child has provided personal data, please contact us.
12. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date will be revised accordingly.
If changes are significant, we will notify users via:
- The website
- Our Discord server
13. Contact
If you have any questions or concerns about this Privacy Policy or data processing, please contact: