DATA & PRIVACY

Know what you measure.

Crumbs is designed for cookie-free website statistics. It does not certify a deployment as GDPR compliant or establish that analytics consent is unnecessary.

From a visit to a statistic

The native canister receives the gateway-provided IP and User-Agent and derives a website-specific daily identifier using a random daily secret. Stored analytics events contain only this identifier and normalized fields. Raw IP/UA still pass through replicated ingress execution; application-level filtering does not promise immediate erasure from gateway/subnet processing or snapshots.

The tracker uses no cookies, localStorage or sessionStorage. It respects Global Privacy Control and Do Not Track. Optional consent gating uses the hosting website's consent manager: set crumbsConsentRequired before loading the script, and set crumbsConsentGranted only after consent. On withdrawal, clear that flag and call crumbs.pause().

Data retained

Normalized paths, referring domain and allowed campaign fields; coarse browser/device/OS categories; country/region/city only in optional Node mode with an operator-supplied local GeoIP database; explicitly allowed event properties; timestamps and optional engagement/revenue measurements. Query strings and fragments are removed. Common email, UUID and long numeric path identifiers are redacted. Automatic redaction cannot recognize every sensitive value: exclude account, reset, medical and other sensitive routes before collection.

Daily identifiers are not a proof of anonymization. Treat retained event data as potentially personal. Retention is configured per website (1–730 days). Expired events are excluded from reports immediately and removed in bounded background passes. Website deletion immediately revokes access and keys; background erasure follows. Snapshots and collector backups need separate retention and deletion procedures.

Your operator's responsibilities

Document the purpose and legal basis, applicable consent requirements, data processing agreements, infrastructure operators and locations, retention, backup deletion, access reviews and incident procedures. Review TLS/gateway configuration, snapshots and logs. Historical daily secrets in snapshots need a short expiry and restricted access. Optional Node mode also requires proxy header replacement and secure disk storage. OpenCloud ownership does not itself establish data residency or confidentiality from infrastructure operators.

Native collection runs directly on your Cloud Engine. Optional Node/SQLite collection moves raw IP processing to your own HTTP ingress. Review every part of the selected path. Do not put API keys, email addresses, order identifiers or other secrets in event properties.

Measurement limits

Ad blockers, offline browsers, closed tabs, IP changes, shared networks and undetected bots affect measurements. Native accepted events are committed before acknowledgment; optional Node acceptance confirms a local queue before later delivery. The current release is alpha and requires parallel validation against Plausible before a production switch.