Privacy and data
What Stickybeak collects
What data analytics collects matters when you write a privacy policy. This page lists what Stickybeak sends, stores and sets in cookies; privacy analytics mode collects less again.
What privacy analytics sends
Each pageview, goal or ping is a small request containing:
| Field | Details |
|---|---|
| Site ID | From data-site. |
| Event type and name | pageview, ping or a goal name. |
| Page address | Cleaned before it leaves the browser. See below. |
| Referrer | The origin only, like https://news.ycombinator.com. Never the full address. |
| Visitor and session IDs | Random strings made in the browser. They aren't derived from anything about the person or device. |
| Session count | How many visits this browser has made, used to tell new visitors from returning ones. |
| Screen width | Used only to tell phones, tablets and desktops apart. Not stored. |
| Goal properties | Only for goals, and filtered: see Custom goals. |
| Automation flag | Whether the browser reports being driven by automation software, for bot filtering. |
The request is sent without cookies and without a Referer header. Like any web request, it reaches our servers with your visitor's IP address and the browser's user agent.
What Stickybeak stores
- The time, event name, path, hostname and goal properties.
- The random visitor and session IDs.
- The referrer's host name, UTM tags, an affiliate code from
?ref=(or?via=,?aff=,?affiliate=), and the traffic channel worked out from them. - Country, region and city, looked up by Cloudflare from the connection. The IP address itself isn't stored.
- Browser, operating system and device type, worked out from the user agent.
- For each session: when it started and was last active, the pages viewed, entry and exit page, and a bot label if it's a bot.
- For each session, the raw user agent and the name of the network it came from (such as an internet provider or cloud host). These are kept so bot detection can be checked and improved.
- For each visitor, a record of their first visit: when, which channel and campaign, and the landing page. It's what lets a sale be credited to where the buyer first came from.
- For purchases: the amount, currency, order ID and the visits that led to it. See Revenue.
How long each of these is kept is on Data retention.
What it never collects
- IP addresses. Cloudflare uses the connection for the location lookup; Stickybeak doesn't read or store the address.
- Fingerprints. The script doesn't probe fonts, canvas, WebGL or anything else to identify a device.
- Full referrer addresses, URL fragments (
#…) or query parameters other than the ones listed below. - Page titles, form contents, text on the page or the text of links people click.
- Anything from other sites. There's no cross-site identifier, and nothing is shared with advertisers.
How addresses are cleaned
Page addresses are cleaned in the browser before they're sent, and again when they arrive:
- Query parameters: only
utm_source,utm_medium,utm_campaign,utm_content,utm_term,ref,via,affandaffiliateare kept, up to 128 characters each. Everything else is dropped. - Ad click IDs such as
gclid,fbclidandmsclkidare reduced to "present". Their values, which can identify the click, are never sent. - Path segments that look private are replaced with a placeholder: anything containing
@, long token-like strings, UUIDs and numbers of five or more digits./reset/8f3a…becomes/reset/:redacted. - Fragments (
#…) are dropped. - Outbound link clicks record only the destination's origin.
It recognises common patterns, not every piece of personal data. If your page addresses can contain names or other personal details in a form it won't recognise, don't install Stickybeak on those pages, or ignore them. Keep goal names and campaign values free of personal data too.
Cookies
The standard script sets three first-party cookies on your domain. There are no third-party cookies.
| Name | Holds | Lasts |
|---|---|---|
_sbv | The random visitor ID | 1 year, renewed on each page load |
_sbs | The random session ID | 30 minutes, renewed with every pageview, goal and ping |
_sbn | How many sessions this browser has had | 1 year, renewed on each page load |
All three are set by the script with path=/ and SameSite=Lax, plus Secure on HTTPS pages. When the page is on the domain in data-domain or a subdomain of it, they're set on that whole domain so your subdomains share them. They're never sent to Stickybeak; the script reads them and puts the IDs in the request.
The script also reads one local storage key, stickybeak:ignore, which you can set to exclude a browser. It never writes to local storage.
Privacy mode sets no cookies at all.