Privacy information

What tracking records

It depends on the privacy tier the site's settings and the visitor's choices allow:

• Anonymous counts (tier 1): the page, the referring site's origin, campaign tags, country, device type, browser family and language, and the names of custom events and goals, with no visitor or session ID.
• Anonymous sessions (tier 2): the same, grouped into visits by a daily visitor code that is pseudonymous within a UTC day.
• Consented analytics (tier 3). Tier 3 keeps a visitor profile that links the visitor's visits and journeys across days. It records the full page address and title, the referring page, campaign tags (UTM), country, device type, browser, operating system, connection type, time zone, language and screen details, time on page, scrolling, clicks on outbound links and downloads, rage clicks (repeated) and dead clicks (unresponsive), performance, errors, form starts and submissions (never what is typed), and the names and details of custom events and goals, and the amount, currency and order ID of revenue events the website sends. If you call identify, it also records the user identifier and details (traits) you supply, and links the visitor's visits to them.

Tier 3 runs without asking on legacy sites and, in regional mode, for visitors outside the consent regions.

Browser identifiers and storage

Only tier 3 stores anything in the visitor's browser. Tier 3 stores a random visitor ID in the first-party cookie _pt_vid, which expires 730 days (about 2 years) after it was last set (the tracker sets it again on every tier 3 page load), and in localStorage and IndexedDB, which have no expiry; it keeps a per-tab session ID in sessionStorage. The server can use a hash of the IP address and user agent, keyed with the site's secret for that UTC day, to recover a visitor identifier seen earlier on the same day.

At tiers 1 and 2, the tracker stores nothing in the visitor's browser. It reads one thing, and only before switching to tier 3: an opt-out saved in localStorage (_pt_consent) by the older optOut() call. If it finds one and the visitor has not accepted, it stays at tier 1.

With anonymous sessions, the server derives a daily visitor code instead (see before consent). A generated visitor name labels a browser identity; it does not change what the underlying records are.

URLs and custom data

In tier 3, page and referrer URLs can contain query parameters, and custom events and identify calls contain the values supplied by the website. Avoid sending sensitive values in URLs, event properties or identifiers. In tiers 1 and 2, URLs keep only their UTM campaign parameters, referrers only their origin, and custom events and goals only their name. UTM values are stored as sent, so do not put personal data in campaign tags.

Visitor controls

• The site's consent banner calls pipetrace.consent("granted") or pipetrace.consent("denied"). A refusal deletes the identifiers Pipetrace stored in the browser and stops tier 3 collection on that page; what is still recorded depends on the pre-consent setting. With consent required in consent regions, a refusal outside those regions is recorded as Anonymous counts, whatever the pre-consent setting, including Off. Pipetrace does not remember the visitor's choice. Your consent tool must store it and load the script with data-consent="denied" on every later page; otherwise, in regional mode, a visitor outside the consent regions who refused gets tier 3 again on the next page, and so does a visitor on a legacy site.
• Global Privacy Control stops all collection: nothing is stored from a request that carries it.
• Do Not Track keeps the visitor at tier 1 at most, even after the visitor accepts. With Do Not Track and the pre-consent setting Off, nothing is stored before the visitor accepts if the visitor must be asked first (consent required everywhere, or a visitor in a consent region). A Do Not Track visitor who is not asked first (outside the consent regions in regional mode, or on a legacy site) is stored as Anonymous counts.
• In tier 3, the legacy pipetrace.optOut() stops collection on that page and saves an opt-out in localStorage (_pt_consent); later pages treat it as a refusal until the visitor accepts. At tiers 1 and 2 it acts as pipetrace.consent("denied"). Opting out or refusing does not erase events already received by the server.

See the data collection reference for implementation details.

Browser analytics retention

Each site keeps its browser analytics for 1 to 25 months, as its owner sets in Settings → Privacy (25 months by default). A job that runs every 6 hours deletes older events, hourly statistics, and visitor aliases and archetype memberships whose visitor has no remaining events. Lowering the retention deletes older data at the next run. Daily secret keys are deleted much sooner. See the privacy tiers page. Site deletion removes its associated analytics records from the live database; operator-held database backups follow their own retention. Retention, account-data handling and operator contact details need to be set out in the operator's published policy.