Sage Universe policy

A live universe built from restrained signals.

The Sage Universe is an optional visual layer for XYZYō. It shows privacy-filtered activity aggregates, not people, purchases, precise locations, or individual browsing histories. This policy covers that Universe feature, and the anonymous product-activity signals the XYZYō home page sends to it, separately from any other product or website policy.

Anonymous presenceShort-lived, opaque session presence only.

Groups, not peoplePublic counts are suppressed or ranged.

No verified feeds yetPayments, security, support, and city feeds are disabled.

What Sage Universe processes

Anonymous activity

When you browse the XYZYō home page, Sage can create a short-lived anonymous presence and group basic activity signals by Sage product: views, interest, onboarding preparation, and outbound actions. You do not need to open the Universe overlay for this. A presence starts with the first activity signal (a product card at least half on screen, choosing a product path or previewing a Pilot scope, completing the optional checklist, or following a product link) or when you open the overlay. The service does not create a public visitor profile or show an individual’s browsing history.

Approximate country and browser time zone

The service may receive an approximate country code from the connection path or trusted proxy configuration. It is not GPS, a street address, or a city-level location. A browser time zone is a browser-reported configuration value; it is not proof of a person’s physical location.

IP addresses

Sage analytics state does not persist raw IP addresses. Separate web-server, proxy, or security logs may process connection information independently to operate and protect the site. Those logs are not Sage Universe activity data and are not displayed by this feature.

Retention and visibility

Live presence

Live presence expires after five minutes without activity. Sage removes stale presence records when it processes a later Sage request; it is not a background tracking process.

Product activity

Public product activity uses UTC calendar days. The private owner dashboard uses Eastern calendar days (America/New_York), with automatic EST and EDT changes. Both sets of daily aggregate counters are retained for up to 35 days. The service also keeps all-time aggregate totals. These are aggregate counters, not a record of a person’s path through the site.

Earlier UTC history remains in all-time totals and is not converted into Eastern daily counts. The owner dashboard shows when Eastern tracking began and identifies date windows that include time before that start.

Public and owner views

Public Universe suppresses groups smaller than three and presents eligible counts as ranges. The authenticated owner view shows exact aggregate counts, including small groups and zero recorded activity. The owner view remains private and does not provide raw visitor identifiers, IP addresses, or a person’s activity history.

What it does not do today

It does not identify people through reverse-IP lookup.
It does not use verified payment, purchase, support, or security-log feeds.
It does not infer or display cities, towns, street addresses, or GPS locations.
It does not present activity as a verified person, customer, sale, or security event.

If a future feature needs a new data source or a more specific location category, it will require separate design, privacy review, and implementation before it appears in the Universe.

Page analytics

What each page sends

Every public XYZYō page loads a small script from xyzyo.com. It sends one record per page view: the page's address without its query string, the name of the referring site (not the page you came from), any utm campaign tags in the address, and the width of the browser window. When you follow a link to another site, it records the kind of link and where it leads: the site and path for Roger Maragh's own sites and app-store pages, and the site name only for anything else. Cloudflare adds a two-letter country code.

What is kept

To tell visitors apart within one Eastern Time day, the service makes a keyed hash of your IP address, browser user agent and the site, using a random value that changes every day. Your IP address and user agent are not written down. The day's records are kept until the day ends. They are then turned into totals (page views and visitors per page, source, country, device type and browser family, and followed links) and deleted together with that day's random value. Totals are kept for up to 400 days. No cookies or browser storage are used, so the same person counts again on a new day.

Your choices and who sees it

Do Not Track and Global Privacy Control turn the script off before it sends anything. Turning off JavaScript does the same.

Only the site owner sees these numbers, on a private page that needs a sign-in. They are not sold, shared or used for advertising.

The same analytics run on Roger Maragh's other sites; see Site analytics privacy.