What we collect, where it lives, and who can read it.
The plain version of how Tracabit handles your visitors' data, including what isn't in place yet.
Last reviewed October 20, 2026
What the tracker sends
This is everything in an event. Nothing here names a person unless your own code attaches it, for example in a custom event parameter or setUserId().
| Field | What it contains | Used for |
|---|---|---|
| Page | URL path, page title, referrer | Which pages people visit and where they came from |
| Session ID | Random ID in sessionStorage, gone when the tab closes | Counting sessions and building funnels |
| Fingerprint | A short hash of user agent, language, screen size and time zone | Telling returning devices apart within a day |
| User ID | Only if your code calls setUserId(); kept in localStorage | Counting signed-in visits |
| Country | Two-letter code, from CDN headers or a lookup in the visitor's browser | The countries report |
| Device | Desktop or mobile, screen size, language, platform | The devices report |
| Events | Event names and the parameters your code attaches | Custom events and funnels |
| Crashes | Error message, file, line and stack trace | The errors report |
| Web vitals | LCP, CLS, FCP and TTFB timings | The web vitals report |
When the CDN doesn't supply a country, the visitor's browser asks country.is, ipwho.is, Cloudflare and OneTrust's geolocation endpoint, and keeps the answer for 30 minutes. Those services see the visitor's IP address. Whether you need consent for the session ID, fingerprint and these lookups depends on where your visitors are, so check with your own counsel.
- No cookies
- The tracker never reads or writes document.cookie.
- No IP addresses stored
- The server reads the country and keeps only that.
- No cross-site tracking
- Nothing links a visitor's activity across different sites.
- No ad networks
- Data isn't sold, shared with advertisers, or used to train third-party models.
Where it's stored
- Hosting
- Fly.io, in Frankfurt, Germany. Volumes are encrypted at rest.
- Backups
- Copied to Cloudflare R2 object storage.
- Transport
- HTTPS only. Plain HTTP is redirected.
- Retention
- You choose, per project. Older days are deleted on schedule.
Who can read it
- Two keys per project
- A public key that can only send events, and a secret key that reads them. They rotate independently from the dashboard.
- Passwords
- Hashed with scrypt and a unique salt per account. We can't see them.
- Password resets
- Reset links expire after an hour, work once, and sign out every existing session.
- Sessions
- Dashboard sign-ins last an hour and renew for up to 30 days.
- Brute-force limits
- Sign-in, sign-up and reset requests are rate limited per IP address.
- Payments
- Handled by Paddle. Card details never reach Tracabit.
Companies that process data for us
Ask Trace sends your project's totals, recent page paths, countries, devices and crash messages to DeepSeek to write its answer. Session IDs, fingerprints and user IDs are removed first. Nothing is sent unless someone on your account asks a question.
| Company | Purpose | Location |
|---|---|---|
| Fly.io | Application hosting and storage | Frankfurt, Germany |
| Cloudflare | Backups (R2) | Set by the bucket configuration |
| Resend | Account and digest emails | United States |
| Paddle | Payments and invoices | United Kingdom |
| DeepSeek | Ask Trace answers, only when you ask a question | China |
Not in place yet
If one of these is a requirement for you, Tracabit isn't the right fit today.
- No SOC 2 report
- We haven't started an audit.
- Not for health data
- We don't sign BAAs, so don't send protected health information.
- No self-hosting
- Tracabit runs only on our infrastructure for now.
- No team accounts or SSO
- Each account belongs to one person.
Found a vulnerability?
Email us with steps to reproduce. Please give us a chance to fix it before you share it publicly.
Legal terms are in the privacy policy and terms.
See exactly what your own site sends in the live events view.
Start free