Privacy & data retention

Retention

Once raw events age out, the aggregate rollups remain available for another year on top of that, so long-range trend charts keep working well past the point individual events are gone.

What is never stored

• Raw IP addresses. An IP is used only to resolve country/region and to compute the visitor hash, then discarded within milliseconds. It is never written to storage or to any log.
• Full user agents. Only derived, low-cardinality fields are kept: device_type, browser + browser_version, os.
• Cookies, localStorage or sessionStorage values. The tracker script writes none of these; nothing it sends can be replayed to identify a return visit beyond the current day's hash.
• Form data or request bodies, beyond the small set of fields each source's documentation lists (see Sources).
• Full query strings. Only utm_* parameters and ref are kept; every other query parameter is stripped before the event is recorded.
• A stable, long-lived visitor identifier of any kind.

Visitor and session hashing

A visitor is identified by a salted hash of the visitor's IP address and user agent, combined with the site id and a salt that changes every day. A session is derived from the visitor hash plus a 30-minute rolling window, computed at ingest. Both are stored only as fixed-size hashes, never as the inputs that produced them.

The salt rotates at 00:00 UTC. The previous day's salt is kept for 2 days to cover events that arrive late, then permanently deleted. Once a salt is deleted, hashes computed with it become unlinkable: there is no way to recompute or reverse them, and no way to tell that two hashes from different days came from the same visitor.

Server and edge sources send the visitor's IP in a request header and let MetrikStack hash it. The IP is discarded within milliseconds of arrival.

Global Privacy Control (GPC)

navigator.globalPrivacyControl is recorded, not used to drop the event. Because no personal data is retained in the first place, there's nothing meaningful to opt a visitor out of by discarding their pageview. Instead the flag is captured so aggregate reporting can reflect how many visitors sent it.

Error reports

Error tracking (see Errors) carries the same privacy guarantees as events, with one explicit exception: error text and stack traces are stored as your own code produced them, minus a denylist. Values whose key looks like a credential (password, token, secret, authorization, and similar), card numbers, and IP literals are filtered at ingest, but free text is not scanned for e-mails, IBANs or other personal data.

• Request headers are filtered, not dropped. Server errors carry HTTP method, status code and headers; cookie, set-cookie, authorization, proxy-authorization and any *-api-key / *-token-style header are always replaced with [Filtered], in the SDK before it leaves your process and again at ingest.
• Free text is sent as your code wrote it. An error message or stack trace that contains something sensitive because your own logging put it there will reach us as written, past the denylist above.
• beforeSend exists for exactly this. The Node SDK's beforeSend(report) hook runs last, before anything is queued, so you can scrub or drop a report before it ever leaves your server.

Everything else about errors follows the rest of this page: no request bodies, no cookies, no raw IPs, no user identity, and browser/OS/country derived from the same daily-rotating hash as pageviews.

Bots

Bot and AI-crawler traffic is stored like any other event (see Bots & AI crawlers). It is filtered out of default dashboard views, not dropped at ingest, so you can report on which crawlers read your site.

Hosting

MetrikStack is hosted in the Netherlands. Visitor data is processed and stored in the EU and does not leave it as part of the standard pipeline.