Data and privacy

This page is about the visitors to the sites you track. For what we do with your own account data, read the privacy policy.

What is recorded for each event#

• The page path and the referrer's host name.
• UTM tags, and ad click ids if the landing address had them.
• Country, device type, browser and operating system. These are worked out from the request and the IP address is then dropped.
• How long the page was visible.
• A visitor hash, so one person counts once.
• For a click: the short link it was.

Conversions your tags report#

When Conversions your tags report is on (the default), the script also notices the signups, purchases and leads your site sends to Meta, Google, TikTok or Pinterest. From each it keeps the event name, the value, the currency, the order id and Meta's event id. It never reads emails, phone numbers, names or the hashed details those tags send for matching. See Signups and sales with no setup.

What is never stored#

• The IP address.
• The full user agent string.
• Cookies or anything in the browser, in Private mode.
• Plain emails and phone numbers in your stats. Emails and phones you send are kept only as a SHA-256 hash, except that customer profiles keep the email, name and phone number (and details from an import) encrypted while Show contact details is on.

The visitor hash#

In Private mode a visitor is sha256(salt, site, IP, user agent). The salt changes every day and the old one is deleted. So nobody, us included, can link a visitor across days or across sites.

In 90-day tracking the script also keeps a random first-party id on your domain for 90 days. It is not linked to any other site.

Visitor profiles#

With 90-day tracking, after consent when you wait for it, each first-party id gets an anonymous visitor profile in D1. It keeps the random id, first and last seen, the number of visits, the landing page, the first and latest source and ad platform, countries, devices and the browser. It keeps no IP address, email, phone or name. It is deleted 90 days after the last visit. Its page reads the visits themselves from the event store. In Private mode no profile is made.

Where it lives#

Datacenter runs on Cloudflare. Events are stored in Cloudflare Workers Analytics Engine. Accounts, sites, links and goals are stored in Cloudflare D1. We do not offer EU-only hosting today.

How long it is kept#

Your plan sets how far back you can see: 30 days on Free and 2 years on Solo, Studio and Agency. See Billing and limits.

Export#

Every list in the dashboard has a CSV export. For a copy of everything in your account, open Settings, then Download my data: a zip of JSON files, with CSV for profiles and links.

Delete#

Delete one customer or visitor, or forget an email for a data request, on the site's Profiles tab. A deleted visitor's device id is never given a profile again on that site. See Profiles.

Delete a site in its settings to remove it from your account. To close your account, open Settings, then Delete account. We cancel your plan, turn the account off at once and delete its data within hours. The privacy policy has the details.

Sending data to Meta#

Nothing goes to Meta unless you connect a site to the Meta Conversions API and mark goals to send. Then only those goals' conversions are sent, with hashed contact details. The same holds for the platforms under Send results to your ad accounts.

What went to Google Ads or Microsoft Ads for a sale (the click id and hashed contact details) is kept encrypted for 30 days, so a refund can change that sale. It is deleted after that, or as soon as you turn off Refunds or the platform.

Global Privacy Control#

A visitor whose browser sends Global Privacy Control (Sec-GPC: 1) is never sent to Meta or any other ad platform. With 90-day tracking, the signal is kept with their random id for 13 months, and later sales or deals tied to it are not sent either. First-party statistics are not a sale or a share, so the visit is still counted.