Skip to content
Trailic
FR

Privacy approach

Count what happens, without keeping who.

This is what the code does, including where it falls short. It’s general information, not legal advice: consent obligations are the site owner’s, and depend on where a site runs and what it does.

What’s collected

  • The path of the page, with its query dropped, keeping utm_* tags only on a site that has turned anonymous mode off, and emails and long tokens replaced by [email] and [token].
  • The referrer’s host, on the first page of a load, unless it’s the site itself.
  • The events and traits the site sends.
  • From the request: a country, a coarse device (desktop, mobile, tablet), browser and system, and the hash below.

What isn’t

  • No address is stored, anywhere: the buffer and the database never see it.
  • No user agent is stored.
  • No cookie is ever set.
  • Nothing is kept in the browser until identify, which keeps the id it was given in localStorage and reset removes, or until a visitor objects, which optIn takes back.

The hash

A visitor is sha256(salt, site, address, user agent), where the salt is derived from TRAILIC_SECRET and the day. So the same person is someone else tomorrow, and on another site. In anonymous mode, on by default, the address is first shortened: IPv4 to /24, IPv6 to /48.

sha256(salt(TRAILIC_SECRET, day), site, address, userAgent)

What it costs, and what it doesn’t protect

  • Everyone behind one address with the same browser is one visitor, which is a known undercount. In anonymous mode, so is everyone in one /24 or /48 with the same browser.
  • A visitor is one per site per day, so a period’s visitors add its days up.
  • Whoever holds TRAILIC_SECRET and knows someone’s address and browser could work out that person’s hash for any day. It stops anyone reading who visited from the database, not someone with the secret and a suspect.

Identifying someone

Only with anonymous mode off: it refuses identify. Only identified people can be followed from one day to the next, so retention counts only them, and someone anonymous can only convert in a funnel within a day. What a visitor did in the half hour before identify becomes theirs, on the same hash, so a funnel that starts anonymous and ends signed in stays one person’s. Two people behind one address with the same browser can be mixed up in that half hour. Prefer an opaque id to an address: userId and traits are whatever your project sends.

The choices a site has

Anonymous mode
On by default, per site, and switched on the site’s page. It shortens the address before the hash, keeps no UTM tags, refuses identify and never counts sign-in, account, admin or profile areas. Figures stay exact counts in both states.
optOut()
How a visitor objects, with a button for a privacy page in trailic/opt-out. Nothing more leaves that browser, which remembers the choice once they’ve made it.
consent={false}
Holds everything in memory until it turns true: nothing is sent or stored before that. Withdrawing it removes what identify kept.
respectPrivacySignals
Sends nothing for a browser saying Do Not Track or Global Privacy Control. Off by default, because nothing here follows anyone across sites, but that’s the site’s decision.

Erasing someone

A person’s page has a button for when they ask: their events, their traits, and their part in the days whose raw events are still there go at once. What’s still in the buffer about them is dropped when it arrives, by a hash of who they were, kept for eight days and no longer. Days whose raw events have aged out are counts with nobody in them and stay as they are.

How long things stay

90 days of raw events by default, between 14 and 730 per site. A daily job deletes whole days past each site’s retention. Someone unseen for as long is forgotten too, traits and all. Rollups, which are counts, stay until the site is deleted.

Consent is your decision

Whether a site must ask, and what it must tell its visitors, depends on where it runs and what it does. Trailic gives the means, and says plainly what it does so that a site’s owner can decide. No cookie doesn’t by itself settle the question.

Read: do analytics need a cookie banner?