Privacy and your data

Dodolytics is made to measure your website without following people. This article explains what it records about your visitors, and what it does not.

What the tracking script sends

For each page load, the script sends:

• The domain and the path of the page, for example /pricing. The part after ? in the address is not sent, except the UTM campaign tags and a ref or via tag. For an ad click ID such as gclid, only its name is sent, never its value.
• The address of the page that sent the visitor (the referrer).
• The screen size, the browser language, and the timezone.

When a visitor clicks a link to another website or to a file, the script sends the address of the link, without the part after ?. If you turn on scroll depth, it also sends how far the visitor scrolled. See Tracking script options. If you use the checkout match, the script also sends a random code for the page view; see Revenue attribution.

From the request, Dodolytics also finds the browser, the operating system, the device type, and the country. Region and city come from the network that carries the request, not from a separate location service.

What Dodolytics does not record

• No cookies. The script does not set cookies, and it does not store anything in the visitor's browser. The one exception is your own browser, if you exclude it: the script then keeps one value there, and never sends it.
• No IP addresses of visitors. The IP address is used one time to make an anonymous code, and then it is discarded. It is never written to the database. Only the addresses that you add to Exclude visits are stored.
• No tracking across sites. The data of each website is separate.
• No sale of data. Your data is not sold or given to advertisers.

How visitors are counted

To count unique visitors, Dodolytics makes a code from the IP address, the browser details, the website, and a secret value that changes every day. The code cannot be changed back into an IP address. Because the secret value changes each day, the same person gets a new code the next day. So Dodolytics cannot follow a visitor from one day to the next, and a person who visits on two days counts as a visitor on each day.

The one exception: identified visitors

If your website's code calls analytics.identify(email), that visitor is linked to their email address on your website, also across days. This is optional. Dodolytics never finds an email by itself. It is used for revenue attribution.

• The email is stored encrypted, and you see it only in your own reports.
• The same email on two websites gives two separate records.
• If a visitor asks you to forget them, open the website's Settings, find Erase an identified visitor, type the email, and click Erase. The email is removed. The visits stay in your reports without a name, like every other visit.

If you use analytics.identify(), tell your visitors in your own privacy policy.

Where the data is kept, and for how long

• The data is stored on the Dodolytics server, not in a third-party analytics cloud.
• It is kept until you delete it. You can delete a website or your whole account at any time.
• The database is backed up each day. Backups stay on the same server, only the administrator can read them, and they are deleted after 14 days.
• Only you and your team members see the reports, unless you make a public dashboard. A public dashboard shows totals only, never revenue or single visitors.

Do I need a cookie banner?

Dodolytics sets no cookies and stores no IP addresses, so many site owners use it without a consent banner. But the rules are different in each country, and they also depend on the other tools on your site. Ask a legal adviser if you are not sure. You can also read our Privacy Policy, which also lists the companies that handle data for Dodolytics.