Privacy

Maximizii is made by Pixel Worship, LLC (“we”). There are two groups of people here: visitors to websites and apps that use Maximizii, and developers with a Maximizii account. This page covers both, including your rights under the GDPR, the UK GDPR and California’s CCPA. Last updated November 6, 2026.

Who’s responsible for what

• If you visit a site that uses Maximizii, that site’s owner decides to use it and why. They’re the controller (under the CCPA, the business), and we process data on their behalf as their processor (service provider). Their privacy notice applies too.
• If you have a Maximizii account, we’re the controller (the business) for your account data.

If you visit a site that uses Maximizii

The script records:

• Page views: the page’s path, its title, your screen size, and whether it’s a phone, tablet or desktop.
• Clicks and taps: where they land, which element they land on, and a short label taken from the button or link.
• How far you scroll, and how long the page is on screen while you’re active.
• The website that sent you (only its host), and any campaign tags on the link.
• The country you’re in, from our CDN.
• Now and then, a picture of the page itself: its layout and text, with form values removed, used as the background of the heatmap. A site’s owner can blank all of its text, or parts of it, and is responsible for doing so on pages that show people’s personal details.

It does not record:

• Anything you type. Form values, textareas and editable text are never captured.
• Query strings, since they often hold tokens and email addresses.
• Email addresses or long numbers in the page’s text. They’re scrubbed in your browser, and again on our servers.
• Your IP address. It’s used once, in memory, to count daily visitors, and it isn’t stored or passed on.

Consent in the EEA, the UK and Switzerland

If you’re in one of these places, Maximizii stores and collects nothing until the site tells it you’ve agreed, normally through its cookie banner. It goes by your device’s time zone, and our servers also check your country and discard anything sent without that agreement. A site’s owner can turn this off if they’ve decided they have another legal basis, and then that decision, and telling you about it, are theirs.

The legal basis for this processing is the site owner’s to choose and to tell you about: normally your consent in those places, and their legitimate interest in understanding how their site is used elsewhere.

Cookies and identifiers

Maximizii sets no cookies. Your browser keeps one random id for the open tab, in session storage, which goes when you close it, or when you withdraw consent or opt out. Daily visitors are counted with a one-way hash of the site, your IP address, your browser’s user agent and a random salt. The salt is deleted after two days, after which the hash can’t be worked out again, and the same person on two days counts twice.

Saying no

The script doesn’t run if your browser sends Global Privacy Control or Do Not Track. A site can hold everything back until you’ve answered its cookie banner, stop when you change your mind, and opt you out with maximizii.optOut(), which is remembered in your browser’s local storage.

How long it’s kept

• Daily rollups and heat data: 90 days.
• Raw event batches: 30 days, as insurance against a bug in our processing. They hold no visitor hash.
• Visitor hashes and the daily salt: two days.
• Page pictures: only the latest for each page and device, until it’s replaced, and a year at most.
• Account details: until you delete your account.
• Counts of sign-ups per page of this website: 400 days. They say nothing about anyone.
• Invitations to a site: until they’re accepted or cancelled, or 30 days have passed.
• Technical logs: one month. They hold no IP addresses from visitors.
• Backups of our database: up to 35 days, so something deleted can stay in a backup that long, unused, until it ages out.

When a site’s owner deletes a site, its pages, rollups, heat, pictures and raw batches are deleted with it.

If you have an account

We keep your email address, your name if you give one, the sign-in details Amazon Cognito needs, and the sites you’ve added. If you sign in with Google, Google tells us your name and email address. If you signed up through a link on this website, we also keep which page it was on, such as /hotjar-alternative, so we can tell which pages are useful. We send email only for things like sign-up codes, password resets and invitations.

If you invite someone to a site, we keep the address you gave and send them one email saying who invited them and to which site, plus any you send again. Please only invite people who’d expect to hear from you. If they sign in with that address they join the site, and the site’s owner and the other people on it can see their name and email address. Anyone can leave a site, and the owner can remove anyone. If you got an invitation you didn’t want, you can ignore it: it ends after 30 days.

If you use the assistant in the dashboard, your question and the figures it needs to answer are sent to Claude, a model made by Anthropic and run by Amazon Bedrock, to get the answer. We don’t save your questions, and we don’t use them to train anything.

Our legal bases: running the service you signed up for (GDPR article 6(1)(b)); our legitimate interest in keeping it secure and working, and in knowing which pages of this website lead to sign-ups (article 6(1)(f)); and meeting legal obligations (article 6(1)(c)). We don’t sell your data or use it for advertising, and we don’t make automated decisions that have legal or similarly significant effects on you.

Your rights under the GDPR and the UK GDPR

You can ask to see your data and to get a copy, to correct it, to delete it, to restrict or object to how it’s used, and to take it elsewhere, and you can withdraw consent at any time. You can also complain to your data protection authority.

• With an account: the Account page lets you download everything held about your account and delete it yourself. Anything else, email us and we’ll answer within a month.
• As a visitor: we hold nothing that says who you are, so we can’t find your data from your name or email address. Ask the site’s owner, who can delete a site’s data, and use the controls above.

Your rights in California

In the last 12 months we’ve collected these categories, for the purposes described above:

We do not sell personal information or share it for cross-context behavioral advertising, and we never have, so there’s nothing to opt out of. We disclose it only to the service providers on our subprocessors page, and don’t knowingly collect data from anyone under 16 for our own purposes. How long it’s kept is above.

You can ask to know what we’ve collected, to get a copy, to delete it and to correct it, or have an authorized agent ask for you, and we won’t treat you differently for asking. Email us: we’ll confirm it’s you, usually from your account’s email address, and answer within 45 days. If you’re a visitor, we’re the site owner’s service provider, so please ask them. Global Privacy Control is honored as an opt-out.

Who else is involved

Maximizii runs on Amazon Web Services in the United States. The full list, and what each one does, is on our subprocessors page. Data from the EEA, the UK and Switzerland is therefore transferred to the United States, relying on the European Commission’s Standard Contractual Clauses and the UK Addendum. Customers can ask us for a data processing agreement at the address below.

Children

Maximizii is a tool for developers, and accounts aren’t meant for anyone under 16.

This website and the dashboard

This website and the dashboard use Google Analytics, loaded through Google Tag Manager, to see which pages people find useful. It sets cookies, and it sends Google the pages you visit, the site you came from, your device and browser, and your IP address. Google keeps this for up to 14 months. On this website it also measures our own Google Ads: if you came from one of our ads, a cookie keeps that ad’s click id, and Google Ads is told if you then follow a “Create an account” link, so we can see which ads work. We never use any of this to personalize ads or to follow you with ads elsewhere. In the EEA, the UK and Switzerland it sets no cookies until you choose Allow on the cookie banner, and if your device’s time zone is in Europe, nothing goes to Google until then. That consent is our legal basis (GDPR article 6(1)(a)). Elsewhere it runs unless your browser sends Global Privacy Control or Do Not Track, or you say no. You can change your choice at any time with Cookie settings, at the bottom of this website and on the dashboard’s sign-in and Account pages, and saying no removes its cookies. This website and the dashboard each keep their own choice.

In the dashboard, the addresses Google sees include your site’s id and a scrambled id for the page you’re looking at, and if you follow a link out of the dashboard, Google sees that link’s address. Google doesn’t get your email address, your sites’ figures, your page paths or your heatmaps.

Everything else on this website, including its fonts, is its own. Its “Create an account” links name the page they’re on and nothing about you, and following one adds one to that page’s count. The dashboard keeps only what signing in, your theme and your cookie choice need in your browser.

Changes

If this page changes in a way that matters, we’ll update the date above and, where the law requires it, tell you directly.

Contact

Questions, or to use any of these rights: hello@notii.site.