Analytics data inventory
Every field Privatus Analytics stores about visits and events, why it is needed, how it is minimized and how long it is kept, plus what stays in memory only.
Stored per event#
One row per pageview, custom event, engagement ping, Web Vital or click.
| Field | Purpose | Minimization |
|---|---|---|
| Site | Which site the hit belongs to | Our id for your site |
| Event id | Makes each row unique, so a hit delivered twice is stored once | Random, time-ordered id. Not derived from the visitor |
| Time | All reports | When the hit arrived |
| Type | Tells pageviews, custom events, engagement, Web Vitals and clicks apart | One of five values |
| Hostname and path | Pages report | Query string removed except your allowed parameters, fragment removed except in hash routing, path masks applied, PII scrubbed, at most 2,048 characters |
| Referrer host and path | Sources | www., m. and similar prefixes stripped, query string dropped, your own domains blanked, path PII scrubbed |
| UTM source, medium, campaign, content, term | Campaigns | Stored as sent, at most 255 characters each. Don't put personal data in them |
ref |
Campaigns | The ref, via or source query parameter, as sent, at most 255 characters |
| Paid click (yes or no) | Channels | Click ids (gclid, gbraid, wbraid, msclkid, fbclid, ttclid, li_fat_id, twclid, dclid) are reduced to this flag. The ids are not stored |
| Channel | Channels | Derived from the referrer and campaign fields |
| Country | Locations | Two-letter code from the CF-IPCountry header Cloudflare adds to each request. No region, city or coordinates |
| Language | Locations | navigator.language, at most 16 characters |
| Device type, browser and major version, OS and major version | Technology | Parsed from the User-Agent. The raw User-Agent is dropped |
| Screen size bucket | Technology | xs under 414 px, sm under 768, md under 1024, lg under 1440, xl above. The exact width is dropped |
| Visit id and visit start time | Groups hits into a visit | Random id, not derived from the visitor, used for at most one UTC day |
| Event name | Events | Custom events only, at most 120 characters. Not PII scrubbed |
| Properties | Events | At most 30 per event. Text (at most 500 characters, PII scrubbed), numbers, yes/no values and lists of text (each item PII scrubbed) |
| Revenue, currency, revenue in the site currency | Revenue | The amount and currency as sent, plus the amount converted to your site's currency |
| Engaged time, scroll depth | Engagement | Time capped at 4 hours, scroll in 10% bands |
| Web Vital name and value | Performance | LCP, INP, CLS, FCP or TTFB and its value, sampled at your site's sampling rate |
| Click selector | Click maps | Only with the clicks module. A short CSS selector (at most four elements, tag plus id or two classes, names with three or more digits, or eight or more capital letters or digits, in a row skipped, and classes with a colon skipped), or the name the site gave the element with data-privatus-click. At most 512 characters. No text or coordinates. Opening the click map on your page stores nothing |
Stored per visit#
One row per visit, built from its hits.
| Field | Purpose | Minimization |
|---|---|---|
| Site, visit id, start time, last seen time | Visits, visit duration | Same random visit id as above |
| First visit of the day (yes or no) | Counting daily visitors | A flag only |
| Hostname, entry page, exit page | Entry and exit pages | Same minimization as the event path |
| Pageview count, event count, engaged time, deepest scroll | Bounce rate, engagement | Totals for the visit |
Referrer, UTM fields, ref, paid click, channel |
Sources | From the visit's first hit, minimized as above |
| Country, language, device type, browser, OS, screen size bucket | Locations, technology | From the visit's first hit, minimized as above |
| Revenue in the site currency | Revenue | Total for the visit |
| Interaction (yes, no or unknown) | Telling people from bots that load a page and leave | One flag per visit: whether a mouse, touch, key or wheel input was seen. Nothing about the input itself. Unknown for a self-hosted copy of an older tracker and for data from before 1 October 2026 |
On-site surveys store one response row per submission (the survey, the site, the workspace, whether it was finished, the page path with your path masks applied, the device type, the two-letter country and the time) and one answer row per answered question (the question's id, a text value for a choice label or the scrubbed free text, a number for a rating or an NPS score, and the time). There is no visitor id, and no question type asks for a name or an email address.
Held briefly, never in the database#
| Data | Purpose | Lifetime |
|---|---|---|
| IP address | Bot checks, IP-range traffic rules, visit key | The request, in memory only |
| Raw User-Agent | Parsing, bot checks, visit key | The request, in memory only |
Browser time zone name (tz) |
Compared with the country of the request for the bot score | The request, in memory only. Never stored with a visit or an event and never used as a location. The one place it is kept is a honeypot hit, for 12 months |
| Do Not Track and Global Privacy Control flags | Deciding whether to drop the hit, see DNT and GPC | The request, in memory only |
| Daily salt | Visit key | Kept in our in-memory store (Redis) and expires 30 minutes after the UTC day ends |
Visit key, HMAC(daily salt, site, IP, User-Agent) |
Continue a visit, count a visitor once a day | Kept in Redis only. The visit entry expires after 30 minutes of inactivity and never outlives the UTC day. A once-a-day marker with the same key expires when the UTC day ends |
| Minimized events waiting to be written | Ingest buffer | Until written to the database, normally seconds |
| Live view feed | The Live page | The last 100 minimized hits per site (time, type, name, path, channel, referrer host, country, device, browser), for at most one hour |
Aggregates#
| Data | Purpose | Retention |
|---|---|---|
| Filtered hit counts per day (bots and traffic rules by reason and country, redactions by rule) | Show what was filtered | 13 months |
No IP address or User-Agent is stored for bots or blocked hits.
Testimonials#
Testimonials stores what a person chose to send you, which is personal data of another kind than the visit data above. None of these tables has a field for an IP address or a User-Agent, of the person who gives a testimonial or of anyone who sees one.
| Data | Purpose | How it is minimized | Kept |
|---|---|---|---|
| The person: name, job title, company, company and social links, photo | Shown with their testimonials, as far as their consent allows | What the person typed, or what the public review page showed | Until the person is deleted permanently or the site is deleted |
| The person's email | Groups one person's testimonials, and lets you ask again | Never shown publicly, never in a webhook or an alert. Shown in the app and the API only to members with content.write |
With the person |
| The testimonial: words, title, rating, highlight, language, your own properties | The testimonial itself | What was sent or what the source page showed | 30 days in the trash after a delete, then removed with its files. Delete permanently removes it at once |
| Where it came from: route, platform, link, the platform's own id, whether it is verified | Shows the source, and stops the same review arriving twice | A platform name, a public address and an id | With the testimonial |
| Edit history: earlier versions of the words and who changed them | Shows what the person wrote before your edits | The words and the member. No address | With the testimonial |
| Consent record: the wording shown, the four answers (name, photo, video, marketing), the time, whether a reward was offered | Proof of what the person agreed to | The text and yes or no answers. No IP address, no User-Agent | With the testimonial |
| Video, audio and image files | The recording or picture a person sent | The upload as it was sent is private and deleted once processed. Location, device and time written by the camera are removed. A finished file has one address, which the app gives only to members of the site until the testimonial is approved. See Video, audio and images | Deleted with the testimonial |
| Raw form answers, and the values your link carried | The answers to your form's own questions | Each value cut at 200 characters. Name, email and photo are not copied here | With the testimonial or feedback it led to. One started and never sent is removed after 7 days |
| Private feedback: rating, words, optional name and email | A low rating routed to your team | Never public, never a testimonial, never in a webhook | Until the form or the site is deleted |
| People you ask by email: address, name, company, job title, and where each is in the funnel | Sending requests and their follow-ups | What you supplied. The personal link is stored only as a hash | With the request |
| An opened request email | The Opened number | A time, set once per email. No IP address, User-Agent, cookie or device. See what the open counter records | With the request |
| Addresses that unsubscribed, bounced or complained | So nobody is asked again | Only a SHA-256 hash of the address | Kept, so the opt-out holds |
| A removal request: the email and the note the person typed | Lets you check the request is real | Never public. The email is shown only to members with content.write |
Deleted with the testimonial |
| Translations of the words | Showing a testimonial in a visitor's language (Business) | Only the words, title and highlight are sent to the translation provider. Never a name, email or company | With the testimonial |
| Views of forms, widgets, walls and public pages | The Analytics tab | Daily totals. No row per visit or visitor. The only details are a channel, a page, a two-letter country and a route | Your plan's history |
| Pages a widget was seen on | Where it is live | The page's host and path, never a query string. Nothing about the visitor | Deleted with the widget |
Retention#
Events and visits are kept for your plan's retention: 3 months on Free, and for as long as you subscribe on paid plans. Older data is deleted automatically by a daily job. On any plan you can set a shorter period for a site in Site settings → Privacy → Data retention (3, 6, 12, 13, 24, 36 or 60 months, up to what your plan keeps).
You can delete a site's data for a date range, delete a site or delete your whole workspace at any time (the date range is Reset data in Site settings → Danger zone). See Cancellation for what happens when you leave.