Security
How Lomen protects your data
This page describes how the product handles your data and your visitors' data right now, including the settings you decide on yourself. No roadmap, no promises, no certification claims.
What the product does with your data
These are the controls in place in the product as it stands.
No cookies, and storage only if you choose it
The script never sets a cookie. By default it stores nothing in the visitor's browser either: a visitor is recognised for one day by a hash of the site, their IP address and their user-agent, mixed with a random salt that is made for that day and deleted soon after it ends, the way Plausible does it. Only the hash is saved, and it changes every day and differs between sites, so nobody can be followed across days or sites. If you pick "With storage" when you install the snippet, it keeps a random ID in the visitor's localStorage so returning visitors are recognised across days. That is your call, and depending on where you and your visitors are, it may need their consent.
What a pageview records
The path and the page's title, the referrer, a coarse device, browser and system, one of four screen-width bands, a country from the edge's own lookup, and the five UTM campaign tags. Not the full query string, not the IP address and not the user-agent string: those two are read in memory for the daily visitor key and a one-minute rate limit, then dropped.
Bots and copied snippets are dropped
Crawlers, headless and automated browsers are thrown away rather than stored. A pageview only counts when it comes from the domain you added or one of its subdomains, so a copied snippet cannot pour made-up traffic into your dashboard, and one address can send at most 120 pageviews a minute to a site. That stops copying and floods, not a determined forger with a script, a limit every script-tag analytics tool shares.
Nothing to hand over, nothing left behind
Lomen measures your site with one script tag you add yourself: no API key, no account to connect and no write access to anything you own. Delete the tag and collection stops at once. Remove the site in Lomen and its entire pageview history is deleted with it, without waiting on a support request.
Revenue keys: read-only, encrypted, removable
Showing your income is optional. Stripe and Paystack only accept a restricted key; a full secret key, which can move money, is refused by the app and by the database. Keys for Stripe, Shopify, Lemon Squeezy, Polar and Paystack are checked with the provider first, stored encrypted in the database vault and never sent back to your browser. Lomen only ever reads payments and orders, and disconnecting deletes the key and the fetched history.
Row-level security on our database
Every table is behind row-level security. You can only read your own sites, pageviews, revenue figures and billing row. Privileged billing fields are protected by a SECURITY DEFINER trigger so they cannot be altered from a client session, and payment keys can only be read through a function that refuses anyone but their owner.
Lomen AI sees totals, not visitors
When Lomen AI answers a question, Google's Gemini model receives the aggregated figures for the chosen period: totals, top pages, sources, countries, devices, and your income per day if you connected a payment provider. Never individual pageviews, visitor keys or credentials. Every number it writes is checked against those figures before you see it.
Claude and ChatGPT only with your approval
Lomen's MCP server lets an assistant such as Claude or ChatGPT read your analytics. It signs in with OAuth, so nothing is reachable until you approve the assistant on Lomen's own consent screen, and then only your own sites, through read-only tools. It cannot change a setting, add or remove a site, or touch your revenue connections.
Managed cloud hosting with TLS
The site, the tracking endpoint and the database run on managed cloud infrastructure, Cloudflare's edge and Supabase, with TLS on all traffic. There is no self-hosted server, and the database is only reached through Supabase's API, where row-level security decides what each account can read. Report emails are sent through Resend and carry figures only.
Compliance status, stated plainly
Lomen is an early-stage product maintained by the Lomen team, and this page is written by us rather than being an independent audit. We are not currently certified under SOC 2, ISO 27001 or any equivalent scheme, and we will not claim otherwise. This page describes the product as it is today; we will update it if that changes.
Responsibility is shared. We secure the Lomen platform, its infrastructure and the data you send to it. You remain responsible for where you install the snippet, which storage mode you choose and whether your visitors need to consent to it, who you give access to your account, which assistants you approve, and how you handle exported reports.
If we discover a personal data breach affecting your account, we will tell you and report it to the authorities where the law requires it. You can delete a site and its history yourself at any time, and email us to have your account deleted.
Found a vulnerability? Email micromacka@outlook.com, with enough detail for us to reproduce it.