DATA & PRIVACY

Know what you measure.

Crumbs is designed for cookie-free website statistics. It does not certify a deployment as GDPR compliant or establish that analytics consent is unnecessary.

From a visit to a statistic

The native canister receives the gateway-provided IP and User-Agent and derives a website-specific daily identifier using a random daily secret. Stored analytics events contain only this identifier and normalized fields. Raw IP/UA still pass through replicated ingress execution; application-level filtering does not promise immediate erasure from gateway/subnet processing or snapshots.

The default cookieless tracker uses no cookies, localStorage or sessionStorage. Optional cookie mode gates all tracking on consent and stores a random first-party identifier for at most 90 days without renewal. The optional choice panel remembers allow/deny for 90 days. Consent setup and withdrawal. Cookie mode stores a site-scoped browser pseudonym, not the raw cookie token, and permits recognition across days. These are still potentially personal data. It respects Global Privacy Control and Do Not Track. Optional consent gating uses the hosting website's consent manager: set crumbsConsentRequired before loading the script, and set crumbsConsentGranted only after consent. On withdrawal, clear that flag and call crumbs.pause().

Data retained

Normalized paths, referring domain and allowed campaign fields; coarse browser/device/OS categories; country/region/city and network data from operator-loaded native datasets, or local GeoIP in optional Node mode; explicitly allowed event properties; timestamps and optional engagement/revenue measurements. Query strings and fragments are removed. Common email, UUID and long numeric path identifiers are redacted. Automatic redaction cannot recognize every sensitive value: exclude account, reset, medical and other sensitive routes before collection.

Daily identifiers are not a proof of anonymization. Treat retained event data as potentially personal. Retention is configured per website (1–1827 days). Expired events are excluded from reports immediately and removed in bounded background passes. Website deletion immediately revokes access and keys; background erasure follows. Snapshots and collector backups need separate retention and deletion procedures.

Your operator's responsibilities

Document the purpose and legal basis, applicable consent requirements, data processing agreements, infrastructure operators and locations, retention, backup deletion, access reviews and incident procedures. Review TLS/gateway configuration, snapshots and logs. Historical daily secrets in snapshots need a short expiry and restricted access. Optional Node mode also requires proxy header replacement and secure disk storage. OpenCloud ownership does not itself establish data residency or confidentiality from infrastructure operators.

Native collection runs directly on your Cloud Engine. Optional Node/SQLite collection moves raw IP processing to your own HTTP ingress. Review every part of the selected path. Do not put API keys, email addresses, order identifiers or other secrets in event properties.

Measurement limits

Ad blockers, offline browsers, closed tabs, IP changes, shared networks and undetected bots affect measurements. Native accepted events are committed before acknowledgment; optional Node acceptance confirms a local queue before later delivery. The current release is alpha and requires parallel validation against Plausible before a production switch.

Optional Google reports

Search Console is connected explicitly, with a read-only token kept in browser memory for that refresh. Only the latest aggregate report is saved for website readers. Search terms are optional and off by default. Disconnect removes the saved report. The Data Studio connector sends aggregates to Google with a website-scoped Read key; Google-held reports have separate retention and sharing rules.

Integration setup and data boundaries →

Native enrichment

Current operator-loaded IP datasets can provide location, ASN and hosting estimates in either tracking mode. No per-visitor external lookup is made. Stored context includes derived attributes, screen size and an untrusted browser automation flag; it contains no raw IP or User-Agent. Classification is not proof of a human or bot. Existing consent, GPC and DNT rules apply.