Transparency

What We Collect

Full transparency on every data point our SDK captures — and everything it doesn't.

What we collect

Page URL and path
Click positions (x, y)
Scroll depth percentage
Device type & viewport size
Referrer URL & UTM params
Anonymous visitor hash (daily)
DOM structure (for replays)
Mouse movements (for replays)

What we never collect

IP addresses (hashed & discarded)
Names or email addresses
Form input content (all masked)
Cookies or persistent identifiers
Cross-site tracking data
Browser fingerprints (no canvas/WebGL)
Location data beyond country
Any personal identifiers

Exact SDK payload

This is the exact data sent to our servers on each page view. Nothing more.

{
  "project": "proj_abc123",
  "url": "/pricing",
  "referrer": "https://google.com",
  "viewport": { "w": 1440, "h": 900 },
  "device": "desktop",
  "utm": { "source": "google", "medium": "cpc" },
  "session": "a8f2e1d4..." // daily-rotating SHA-256 hash
  // NO IP address
  // NO cookies
  // NO personal data
}

How we anonymize visitors

Visitor identification uses an irreversible, daily-rotating hash. No IP is ever stored.

// Server-side — runs before any data is stored
const salt = getDailySalt(); // rotates every 24h at midnight UTC
const hash = sha256(ip + userAgent + salt);
// Result: "a8f2e1d4..." — changes daily, unlinkable
// The raw IP is NEVER stored, NEVER logged

Data reference

Complete list of every data point, with retention period and usage.

Field	Description	Retention	Used for
Page URL	The URL of the page being viewed	Per plan	Behavior maps, scroll maps
Click position	X/Y coordinates of each click	Per plan	Behavior maps
Scroll depth	How far the visitor scrolled (%)	Per plan	Scroll maps
Viewport size	Browser window dimensions	Per plan	Responsive segmentation
Device type	Desktop, tablet, or mobile	Per plan	Device filtering
Referrer URL	Where the visitor came from	Per plan	Traffic source analysis
UTM parameters	Campaign tracking parameters	Per plan	Campaign segmentation
Session hash	Daily-rotating anonymous identifier	24 hours	Session grouping
DOM snapshot	Page structure for replay rendering	Per plan	Session replays
Mouse movements	Cursor path for session replays	Per plan	Session replays

How we compare

Data point	VulpaSoft	Hotjar	GA4
IP address stored	Never	Anonymized	Yes
Cookies set	0	Multiple	Multiple
PII in replays	Masked by default	Manual opt-in	N/A
Cross-site tracking	Impossible	Possible	Yes
Data location	EU only	US	US

Privacy by architecture, not by policy

Start collecting behavioral data the right way.

Start free — no credit card