Privacy and compliance
What a cookieless pageview stores, and how GDPR and CCPA show up in the product.
Last updated on
This page describes what Databob stores. It is not legal advice. Your privacy policy, your lawful basis, and your notices are yours to write. The banner can link to an https privacy policy when you set one.
Cookieless by default
The tracker does not set a cookie. The essential choice is not a cookie either. It is localStorage on the customer site, and only after a banner choice or a Global Privacy Control opt-out.
A stored point does not include:
- IP address
- The full user agent
- A visitor id
Country comes from the edge country code. Device class is mobile, tablet, desktop, or other, from Sec-CH-UA-Mobile and a short check of the user agent. The full user agent string is not written to the point.
What is collected
Anonymous pageview. This is the default, and it is what you get when enhanced analytics is off, when the visitor has not accepted, or when Global Privacy Control or Do Not Track is on.
| Field | Example |
|---|---|
| Path | /pricing, with the query string and fragment removed |
| Content id | The path, unless a direct collect body sent content_id |
| Country | US, DE, or empty when the country is unknown |
| Device class | desktop |
Enhanced pageview. Stored only when enhanced analytics is on for the project, consent.analytics is granted, consent.version matches the version returned with the write key, and the request is not opted out by Global Privacy Control or Do Not Track.
The extra fields are the referrer host (not the full referrer URL) and UTM source, medium, and campaign. A goal event can be stored in that same tier. The goal name has to match the name configured on the project.
Consent event. Action granted, denied, or changed, category enhanced, the version, and the source. No path, country, address, or visitor id.
A direct POST that only says analytics is granted stays anonymous. The Worker still requires the matching consent version from a real choice. consent.source does not raise the tier.
GDPR
Visitors in the EU, the EEA, the UK, Switzerland, and Canada are asked before enhanced analytics. Essential cookieless measurement stays on and does not use a cookie. Accept, Reject, and Customize are equal buttons. Enhanced starts unchecked. Reject, or closing the choice without ticking enhanced, keeps the anonymous tier.
Changing the banner text, the policy URL, the enhanced label, the region, or the enhanced toggle asks again.
Global Privacy Control and Do Not Track opt out of the enhanced tier everywhere, including inside the EU list.
CCPA
California visitors are not prompted and stay on cookieless analytics. Global Privacy Control is honored for them, the same as everywhere else: the banner stays hidden and enhanced analytics stays off. The hosted privacy choices page at /c/<siteId> is where a visitor can still opt in or out. Databob does not sell personal information in the product, and it does not store a visitor id that could be sold. There is no separate "Do Not Sell" endpoint beyond that choices page and Global Privacy Control.
Retention in the product
Ingest writes to Workers Analytics Engine. The dashboard and the data API read Convex snapshots, not the raw points, on a page request. Content snapshots are rebuilt daily at 04:00 UTC for the 7d and 28d windows. enough_data is false when the current window was extrapolated from fewer than three unweighted rows. That row count is not part of the snapshot.
Coming soon
There is no data processing addendum, no EU ingest region, and no billing plan beyond Free in this release.