Privacy notice

Data collected

When installed, the tracker sends the website ID, page path, referrer, device category, screen width, UTM campaign values, and event names. Sites may also send values through the custom event API. Do not send passwords, payment details, or other sensitive personal information in event properties.

The collection service may derive a country from hosting-provider request headers. It uses the request IP in memory to create a daily salted hash; the raw IP is not written to event properties by this handler.

Browser identifiers

Visitor and session identifiers are stored in origin-local localStorage and are scoped to a website ID. They are not shared across website origins. Sessions rotate after 30 minutes of inactivity. If storage is blocked, temporary identifiers are generated and visits may not be joined reliably. Identifiers remain until site data is cleared; there is no tracker cookie.

DNT and consent

The tracker respects the browser Do Not Track signal only when installed with data-respect-dnt="true". Calmstats does not provide a consent banner or consent-state API. The website operator is responsible for deciding whether and when the script may load.

Retention and requests

Automated event-retention and account-level export or deletion workflows are not yet implemented. No retention duration is promised here. Do not use the current prototype where a specific retention, deletion, or regulatory workflow is required.

For requests about data in a Calmstats workspace, contact the operator who provisioned that workspace. Self-service privacy request handling is not currently available.