Privacy

What the SDK never sends

No query strings. No fragments. No DOM text. No form values. No cookies. No persistent identifiers.

The reported route is the raw path only — /checkout, never /checkout?email=alice@example.com. The query string is dropped in the browser, before anything is sent, so it never reaches us to be dropped later.

measurementId correlates a page view’s own events — its interaction event with its page view. It is regenerated per view. It is not a visitor identifier, and there is no way to join two page views by it.

The one field that can carry your data

Interaction events name the element that was slow. By default the SDK reads the element’s id and tagName and nothing else — never innerText, aria-label, title, alt, or any attribute value.

Element ids are yours to control

If your element ids contain personal data, so will this field — exactly as a path like /users/alice@example.com already would. id="row-alice@example.com" is the shape to look out for.

The exception: captureInteractionText

There is one setting that changes this, and it is off by default: captureInteractionText. When you turn it on, an interaction on an element that has no id reports a short excerpt of its text as well:

off  →  button
on   →  button "Add to cart"

An id always wins, and the text is never read when one is present. The excerpt is whitespace-collapsed and truncated to fit a short field.

It exists because button on its own rarely tells you which button. It is off by default because it is the only setting that turns rendered DOM text into collected data — if your buttons render a customer name, an email or an order number, enabling it sends those. Decide deliberately.

Why there is no consent banner

Consent requirements attach to storing or accessing information on a visitor’s device, and to processing personal data. The SDK does neither:

• Nothing is stored on the device. No cookies, no localStorage, no sessionStorage, no IndexedDB. Nothing to read back on the next visit, because nothing was written on this one. This holds on both install paths — the npm build and the script tag are the same code.
• No fingerprint. Device type, connection type and browser are recorded as coarse buckets, not as a canvas hash or a font list. They identify a class of visitor, which is what makes them useful for slicing and useless for tracking.
• Country, not location. Derived at the edge from the request, at country granularity. No IP address is stored.

There is no identifier that survives a page view, so there is no profile to build and nothing to link across sessions. That is a design constraint the system is built around, not a setting.

You should still confirm this against your own obligations — this page describes what the software does, and is not legal advice.

Where data lives

Measurements are written to Cloudflare’s analytics store and read back as aggregates. Raw data points are retained for three months; beyond that, history survives as hourly and daily rollups, which are aggregates by construction and contain no individual measurements at all.

Sampling is not anonymisation

The default sample rate of 0.25 exists for volume and cost, not for privacy. Setting it to 1 does not collect anything the SDK would not otherwise collect — it collects the same fields more often.