The product is built on the assumption that you can analyse what drives revenue without tracking individuals. This page explains exactly what we collect and what we do not, based on how it is actually implemented.
The cookieless design described here applies to our own snippet. If you connect GA4 instead, collection happens on Google’s side.
A ~5KB script you add to your site with one line. It uses no cookies and no localStorage. Everything below describes this path.
We import data from the GA4 property you already run, through Google’s API. Collection happens in GA4, so cookies and consent follow Google’s terms and your own GA4 configuration.
The snippet writes nothing to the visitor’s device, and reads nothing from it.
They are used only to derive the visitor key described below. The raw values are never written to the database.
Only a five-key UTM allowlist is extracted. Everything else in the URL is discarded, so an email address or customer name in a URL never reaches us.
The visitor key includes the site ID, so it cannot match the same person on another site. We build no individual profiles.
Per event, we record the following — all of it in service of “which page, from which source, produced how much revenue”.
Timestamp, page path and page title. Query strings are not included.
Referrer host, UTM parameters, and the channel we derive from them.
Device type (desktop / mobile / tablet), screen-width class, country and region.
Ecommerce event value, quantity, currency, product ID and name, and order ID. No customer names, addresses or email addresses.
The visitor key is a hash of a salt that rotates daily, the site ID, the IP address and the user agent (first 32 characters). That gives it three properties.
The same person gets a different key tomorrow, so nobody can be followed over time.
The same person browsing another site produces a different key. Cross-site tracking is not possible.
Because the IP and user agent are never stored, the key cannot be traced back to a person.
We do not sell your data and do not share it with third parties for advertising.
Tables and charts each have a CSV button, so you can export that view’s data whenever you want. Deletion on account closure follows our Terms and Privacy Policy.
Payments are handled by Paddle as Merchant of Record; card data never reaches our servers.
The script is about 5KB and loads async. Events are sent with sendBeacon, so rendering and navigation are never held up.
Every operation is wrapped in try/catch, so a problem in tracking never affects the site itself.
Requests from known bot user agents are discarded rather than recorded.
If you use only our first-party snippet, nothing is written to the visitor’s device, so it generally falls outside cookie-consent rules. Whether you can drop the banner entirely still depends on the law in your market, on regulator guidance, and on every other tag on your site (advertising, chat widgets and so on). Please confirm with your own legal advisors.
Open the demo — no signup — and explore the cookieless dashboard directly.
Try the demoThe 7-day free trial needs no credit card.
This page reflects the current implementation. For the legal detail, see our Privacy Policy. Privacy Policy