# Privacy & compliance

URL: https://supapulse.app/docs/data-privacy/privacy

What Supapulse collects about your visitors, what it doesn't, how long it keeps it, and what that means for GDPR, ePrivacy and consent banners.

This page describes what the code does today. For the legal terms, see the [privacy policy](https://supapulse.app/privacy).

## What the tracker stores in the browser [#what-the-tracker-stores-in-the-browser]

Nothing. No cookies, no `localStorage`, no `sessionStorage`, no IndexedDB. The session ID lives in a JavaScript variable and disappears with the page.

## What Supapulse keeps for each pageview [#what-supapulse-keeps-for-each-pageview]

- The page URL and path, the referrer, and any `utm_source`, `utm_medium`, `utm_campaign`, `utm_term` and `utm_content` in the URL.
- Browser, operating system and device type, read from the user agent. The user agent itself isn't stored.
- The country, as a two-letter code, and the browser language.
- The session ID and the visitor hash (see [How Supapulse works](https://supapulse.app/docs/data-privacy/how-it-works)).
- The time.

Custom events keep their name, the properties you send, the URL and the visitor hash. Revenue events keep the amount, currency, payment processor, event type, transaction ID, subscription reference, MRR change, session ID, visitor hash, the first and last touch source, and any `metadata` you send. The customer ID you send, from `identify()` or a revenue event, is stored only as a one-way hash.

## What happens to the IP address [#what-happens-to-the-ip-address]

The IP address is used to build the visitor hash and to look up the country. The lookup sends it to an IP geolocation service (ip-api.com, with ipapi.co and ipinfo.io as fallbacks), and the country that comes back is cached against the IP address for up to 7 days. The ingest endpoint also counts requests per IP address for rate limiting. The IP address isn't written to pageview, event or revenue records.

To show how many people are on a site right now, visitor hashes are kept in memory for 5 minutes after their last pageview.

## What Supapulse doesn't collect [#what-supapulse-doesnt-collect]

- Names or email addresses, unless you put them in an event, a URL or a revenue `metadata` field. Don't. Use an opaque customer ID for `identify()`; Supapulse stores it as a hash.
- Cross-site identifiers. The visitor hash includes the site, so it differs on every site.
- Browser fingerprints from canvas, fonts or hardware.

## Retention [#retention]

- Analytics data has no automatic expiry. It stays while the site exists.
- Country lookups are cached for up to 7 days; live-visitor entries expire after 5 minutes.
- Exports expire 7 days after they're created.
- Deleting a site removes it from the dashboard, but the records stay in the database. Email [support@supapulse.app](mailto:support@supapulse.app) to have them erased.

## Consent banners [#consent-banners]

The tracker sets no cookies and stores nothing on the visitor's device, so there's nothing for ePrivacy (PECR in the UK) consent rules to cover on Supapulse's side. GDPR still applies to the data the server processes: the IP address is personal data while it's used, and the visitor hash is pseudonymous data. Most site owners rely on legitimate interest for this kind of aggregate analytics.

Whether you need a banner depends on everything else on your site and on your jurisdiction. Supapulse can't decide that for you, and this isn't legal advice.

## Requests from visitors [#requests-from-visitors]

Supapulse can't find a visitor's records by name or email, because it doesn't have them. The visitor hash can't be recomputed after the salt has rotated. Visitors should contact the site owner, who decides what's tracked; we'll help the owner answer.

## Your part [#your-part]

1. **Keep personal data out of URLs.** Query strings like `?email=` end up in pageview records. Strip them, or send cleaned URLs with `autoPageviews: false`.
2. **Keep it out of events.** Send `{ plan: 'growth' }`, not `{ email: '…' }`.
3. **Mention Supapulse in your privacy policy.** Say you use cookieless analytics, what it records, and who processes it.
4. **Choose a short salt rotation** unless you need longer visitor recognition. See [salt rotation](https://supapulse.app/docs/data-privacy/how-it-works#salt-rotation).

## Certifications [#certifications]

Supapulse has no SOC 2, ISO 27001 or similar certification.