# Privacy: cookieless by default

> How visitors are counted without cookies by default, what the returning-visitors switch adds, what is kept for each visit and how long data stays.

This page explains how Clear Saga counts visitors without cookies by default, what the returning-visitors switch changes, and what is stored and for how long.

> [!NOTE]
> This is not legal advice. There are no legal pages or data processing agreement yet: see [what works today](/docs/status).

## What is not used

- **No cookies by default.** The script sets none unless Remember returning visitors is on for the site, see [further down](/docs/privacy#when-remember-returning-visitors-is-on). With it off, the full script reads that cookie only to delete a leftover.
- **Nothing stored in the browser to recognise a visitor**, with that one exception. The script reads only the opt-out switch below.
- **No stored IP address or browser string.** Both are used in memory while a hit is handled and never written to storage or a log. Only the browser, system and kind of device are kept as names.

## How a visitor is counted

Hits from the same person are tied together by a short code, worked out on the server, that changes every day.

1. On the first hit of a UTC day, each site gets a new random secret. Making it deletes the secret of the day before, for good.
2. For each hit, the server combines the id of the site, the day, the domain of the page, the visitor's IP address and the user agent.
3. These are put through a keyed hash (`HMAC-SHA-256`) with the secret of the day. A short piece of the result is the visitor code stored with the hit.
4. The address and user agent are then thrown away. They serve only this, the bot filter, exclusion rules and a rough location.

- The same person, day, browser and network give the same code, so several page views are one visitor.
- The next day that person gets a different code. Old codes cannot be worked out again, linked to today's, or turned back into an address.
- All hostnames under your site's domain count as one domain. Each site has its own secret, so nobody can be followed between sites.

So a person who returns another day is a new visitor, and visitors over several days are the sum of each day's. People who share a network and use identical browsers can count as one visitor, and one person who changes network mid-day as two.

Returning visitors are not counted over weeks or months unless the switch below is on.

## When Remember returning visitors is on

Each site has one switch, under Settings, Visitors, off by default. [Returning visitors](/docs/returning-visitors) explains it in full. For your privacy notice:

- **The cookie.** One, `clearsaga_v`, on your domain and its subdomains, on https pages, set only by the full script. It holds a long random id.
- **Lifetime.** Up to 400 days after a visit; Safari deletes it sooner ([returning visitors](/docs/returning-visitors)).
- **Consent.** Read from Shopify's banner or your own, or "Not needed". A visitor who has not agreed is counted as above.
- **What is stored.** A profile per id: its visits with their places, devices, sources and pages. No name or email, only a random id kept as a keyed hash. The id as sent is never stored or logged.
- **Withdrawing.** Through your banner or Shopify's: the full script tells the server to forget the visitor and deletes the cookie. [What a visitor can do](/docs/returning-visitors#what-a-visitor-can-do) lists when a withdrawal does not arrive.
- **Requests.** A visitor sends you the cookie's value; Settings, Visitors finds the profile.
- **Deleting** removes the profile and unlinks its visits for good; the visits stay. A hashed marker is kept for 13 months, so the leftover cookie is not linked again.

Your site must tell visitors about the cookie and answer their access and deletion requests.

## What is stored for a visit

For each recorded page view, custom event or missing page ([add the tracker](/docs/tracker) lists what the script sends):

- the time, the path of the page and the hostname,
- the name and the properties of a custom event,
- the site the visitor came from, as a hostname only, the channel it was sorted into, and the AI assistant, when the visit came from one,
- campaign tags, when campaign capture is on,
- country, region and city, as supplied by the network that delivers the request,
- the browser name, the operating system name and whether it was a desktop, a phone or a tablet,
- for a missing page, the path of the page that linked to it,
- the visitor code of the day,
- with returning visitors on, and only for a visitor who agreed, the hashed id of their profile on the visit.

A web vitals sample holds the time, path, hostname, country, browser, system, kind of device, how the page was reached, the measured values and the visit number, used only to drop a duplicate.

With the revenue option on the tag, a hit also stores a keyed hash of a random id made for one page load. A Shopify theme writes that id into the cart, whose cookie is Shopify's own.

An order of a [connected Shopify store](/docs/connect-shopify) keeps its id, time, total, currency, first product and that hash. With Match sales to ads on, each Shopify order also keeps a private customer key, a keyed hash and never the email or customer id ([ad attribution](/docs/ad-attribution)). The customer's name, email, phone, addresses and IP address are dropped before anything is stored. The store's secret is stored encrypted.

The query string of a page is never stored. With Match sales to ads on, one ad click ID and `utm_id` from the landing address are kept ([ad attribution](/docs/ad-attribution)). For a visit, the first and last page are kept, and, for the Realtime map, a location rounded to within several kilometres.

## Signals from the browser

If a browser has Global Privacy Control or Do Not Track on, the script sends nothing and sets no cookie, and the server drops any hit carrying either signal.

## Opting out in one browser

Anyone can stop the script in their own browser by running this in the console on your site:

```js
localStorage.clearsaga_ignore = 'true'
```

This opt-out is kept per hostname, uses no cookie and identifies nobody. [Excluding visits](/docs/excluding-visits) has the details.

## How long data is kept

| Data | Kept for |
| --- | --- |
| Visits, page views, custom events, missing pages and web vitals | 3 years |
| A remembered visitor's profile | 13 months after their last visit |
| Orders, refunds and the hourly counts of accepted and filtered requests | 3 years |
| Each site's own copy of its monthly event counts | 25 months |
| The Activity list of changes made with tokens | 180 days |

Each site clears out what is past its period once a day. Monthly usage totals stay until the workspace is deleted. For sooner removal, see [managing a site](/docs/site-settings).

## Where data is stored

Each site's data is kept apart from every other site's. A choice of data region, or EU-only hosting, is not built: see [what works today](/docs/status).

All of this is about your site's visitors. The dashboard itself signs members in with a cookie, see [your account and signing in](/docs/account).

**Next:** [Returning visitors](/docs/returning-visitors), [Excluding visits](/docs/excluding-visits), [Add the tracker](/docs/tracker)