# The domains Privatus Analytics uses

> The four domains Privatus Analytics serves from, what each one carries, and which to allow in a Content Security Policy or a firewall.

Privatus Analytics serves from four domains. Each one carries one kind of
traffic, so a blocker that stops one never stops the others. Someone who
blocks analytics still sees your testimonials, and nobody's blocklist can
take the dashboard away from you.

| Domain | What it carries | Who asks for it |
|---|---|---|
| `privatusanalytics.com` | The website, the docs, the dashboard, the [API](/docs/api) and the [MCP server](/docs/mcp) | You and your team |
| `privatusstats.com` | The [tracker](/docs/tracker) (`pa.js` and its modules), the hits it sends, [surveys](/docs/features/surveys), [experiments](/docs/features/experiments) and the view counts of testimonial widgets | Your visitors' browsers |
| `privatusads.com` | The [ad loader](/docs/features/ad-experiments) and the impressions and clicks it sends | Your visitors' browsers |
| `privatus.page` | What you show your visitors: [testimonial widgets](/docs/testimonials/install-a-widget), [walls](/docs/testimonials/wall-of-love), [forms](/docs/testimonials/share-a-form) and [testimonial pages](/docs/testimonials/permalinks), [shared dashboards](/docs/reports/sharing), wallboards and [status pages](/docs/features/status-pages) | Your visitors' browsers |

Testimonial photos, video and audio come from `media.privatusanalytics.com`.

## Why separate domains

Privacy tools block analytics, and we never try to get around them. Those
who block analytics are not counted, and that is part of the deal (see
[Ad blockers](/docs/troubleshooting/ad-blockers)). Some blockers work on
whole domains, though. If the tracker shared a domain with your
testimonial widgets or your dashboard, blocking the tracker would block
them too.

So the tracker and the ads each have a domain of their own, named plainly,
and listed here for anyone who maintains a blocklist. Each domain serves
only its own files: `privatusstats.com` and `privatusads.com` carry no pages
and no sign-in.

## A Content Security Policy

Allow the domain of each feature you use:

| Feature | `script-src` | `connect-src` | `frame-src` |
|---|---|---|---|
| Tracker | `https://privatusstats.com` | `https://privatusstats.com` | None |
| Testimonial widgets and walls | `https://privatus.page` | `https://privatus.page` and `https://privatusstats.com` | `https://privatus.page` for the frame embed |
| Testimonial forms (embedded) | `https://privatus.page` | None | `https://privatus.page` |
| Ads | `https://privatusads.com` | `https://privatusads.com` | None |
| Chart widget and shared dashboard embeds | `https://privatus.page` | `https://privatus.page` | `https://privatus.page` |

The details for the tracker are on
[Content Security Policy](/docs/tracker/csp).

## Older snippets

Snippets made before these domains existed load their script from
`https://privatusanalytics.com`. They keep working: the script now sends to the
domain above that matches it. If your site has a Content Security Policy,
allow both, or copy the current snippet from the app, which loads from the
right domain.

Addresses of pages on `privatusanalytics.com`, such as an old link to a wall
(`/w/…`), a form (`/f/…`), a testimonial (`/t/…`), a status page, a
shared dashboard or a wallboard, redirect to the same address on
`privatus.page`. Printed QR codes and links in old emails keep working.