What we collect

1. What is stored

Each pageview, and each event your site sends, stores the following:

The page: its host, path and title. The query string is dropped. So is the URL fragment, unless the site turns on hash routing: then the route part of it stays in the path.
Where the visit came from: the referring page without its query string, and UTM tags.
The device, read from the user agent on arrival: browser and operating system with their versions, and the device type. Also the screen size and the browser language.
The location, looked up from the IP address on arrival in a database on our own server: country, region and city.
A visitor id: a SHA-256 hash of the site, the IP address, the user agent and a random salt that changes every day. A session id built from it.
How long the page stayed in view.
Custom events and the properties the site sends with them, and revenue: an amount, a currency and a hashed checkout id.
A user id, only when the site calls identify(). It is stored exactly as the site sends it.

2. What is never stored

The IP address. It is read once to look up the location and to build the visitor id, then dropped.
The user agent. It is read once to work out the device and to build the visitor id, then dropped.
Ad click ids, such as gclid or fbclid. They are read once to tell where a visit came from and whether it was a paid ad click, then dropped.
Cookies. The tracker sets none, and the request to collect events carries none.

3. How visitors are counted without cookies

Instead of a cookie, the server gives each visitor an id for the day: the hash in the list above. The dashboard counts visitors by that id.

The salt behind each visitor id is 32 random bytes, made on the first event of each day and stored only in our Postgres database. The same visitor gets a new id every day, so ids cannot be linked across days.

Each salt is deleted about three and a half days after its day begins, once no late event can still need it. A job checks every hour. After that, nobody, Highseat included, can work out which IP address an id came from. The daily database backups keep a deleted salt for up to 14 more days.

4. In the browser

A random id for the browser tab, in session storage under highseat_aid. It lets a sale made in that tab be credited to the visit. The browser deletes it when the tab closes, and the server stores only its hash.
The user id from identify(), in local storage under highseat_uid, only on sites that call it. It is removed when the site calls identify(null), and after 13 months.

When a browser sends the Global Privacy Control signal, the tracker turns itself off before it sends anything. No event is recorded for that visitor.

The Highseat tracker sets no cookies and sends nothing from a browser that has Global Privacy Control turned on. Highseat never stores a visitor's IP address or user agent. That supports your GDPR, CCPA and PECR obligations, and most sites that use it for anonymous traffic statistics can drop the cookie banner. Whether your site still needs consent depends on the rules of the countries you serve and on how you use it. The tracker keeps a random per-tab id in the browser's session storage, and identify() keeps the user id you send in local storage. Some regulators treat any data stored on a device as needing consent, so check with your own adviser before you remove a banner.

6. Retention and deletion

Events are kept while the workspace runs, until the customer deletes them, deletes the site or the workspace, or the workspace lapses and its sites are deleted on day 60. Highseat sets no shorter period of its own.

One identified user: on a site's Data settings, an owner or admin can erase every event recorded for one user id, with the rest of each of that user's visits.
Imported history: an import can be deleted on its own, and the site's sessions are rebuilt without it.
A site: deleting a site deletes every event and session it recorded. The delete runs a second time once no late event can still arrive.
A workspace: deleting a workspace deletes its sites, their events and its subscription.
An account: deleting an account deletes the person's profile, sign-in methods, sessions and memberships, and every workspace nobody else belongs to. An account that is the only owner of a shared workspace must hand that workspace over first.

Deleted events disappear from every report at once. They leave the database disk within hours, through a job that runs every hour. Daily backups keep events for up to 60 days and account data for up to 14 days, so a deletion is complete everywhere within 60 days.

7. Where to read more

The security page explains where the data lives and how the tracker is protected. The privacy policy and the data processing agreement are the binding terms, and the sub-processors page lists every service that handles the data for us.