Privacy & collection controls

Consent gates#

Analytics requires server-enabled collection, a valid HTTPS notice and a fresh visitor choice. Optional recording and identification have separate purposes. DNT/GPC and other browser exclusions remain respected. There is no region-based exemption in the current consent gate.

Minimized browser data#

Tracked paths omit query strings and fragments and redact identifier-like segments. Private routes such as account, admin, dashboard, sign-in, password reset, auth and OAuth are blocked by tracker rules. Add your own sensitive areas to site exclusions and recorder block selectors as needed.

Events and identity#

Custom event names are validated. Ordinary arbitrary event properties are dropped; numeric internal metrics are allowlisted. Identification accepts a permitted stable user ID and optional validated email rather than an arbitrary profile object. Avoid encoding personal data in event names or campaign labels.

Recordings#

Recording is optional, sampled and masked. Moderate mode still masks inputs; strict mode masks text too. Review your own captured result because application-specific sensitive content may need extra exclusion. A recording can remain personal analytics data even after masking.

Retention and erasure#

Consent choice lifetime, persistent ID lifetime, credential expiry, audit-log cleanup and raw analytics retention are different policies. A proposed 90-day raw analytics constant is not a guarantee that all production data is purged on that schedule. Operators must verify their actual database/storage retention and deletion jobs. Use the explicit visitor erasure workflow for requests about retained visitor data.

Pause collection#

Disable collection in privacy settings when needed. Queuing a visitor erasure also pauses the site until review. Re-enabling requires the applicable privacy checks; do not treat it as a harmless way to bypass an unfinished privacy request.