click_vitals Get early access

Privacy & data · the full list

Here's everything we collect. And everything we don't.

We'd rather show you the design than claim a badge. This page describes exactly what the script and our servers do, so you and your data protection officer can judge it for yourselves.

Never

  • Cookies
  • localStorage, sessionStorage or IndexedDB
  • Any identifier stored on the device; the page-view ID lives in memory and dies with the tab
  • Tracking parameters added to your links
  • Raw IP addresses written to disk or logs
  • Canvas, audio or WebGL fingerprinting
  • High-entropy Client Hints or font enumeration
  • Query strings or URL fragments: they're stripped before sending, from page URLs, referrers and link targets alike
  • mailto: or tel: addresses that were clicked (we record only that it was an email or phone link)

Collected

  • Performance timings and Core Web Vitals, with the elements that caused them (CSS selectors)
  • Page path, content ID and category, and the referring site (only the host, for external referrers)
  • Clicks: the area of the page, the item, its position, and the link's host and path
  • Engaged time and scroll depth
  • Browser, operating system and device class, worked out on our servers from the user agent
  • Coarse buckets: device memory, CPU cores, viewport width, connection type
  • Country and region, from the IP address before it's discarded
  • Uncaught JavaScript errors (message, source file, line)

§1 · Sessions without cookies

A hash that expires at midnight.

  1. 01

    A beacon arrives. In memory only, we compute sha256(daily_salt ‖ site ‖ ip ‖ user_agent) and keep the first 128 bits.

  2. 02

    We look up the country from the IP, then discard the IP. It's never written anywhere.

  3. 03

    The salt is random, one per UTC day, and shared by all our servers so the same visitor gets the same hash all day.

  4. 04

    At midnight a new salt is created and yesterday's is deleted. Hashes from different days can't be linked, by anyone, including us.

§2 · Where & how long

Data storageAWS London (eu-west-2), UK.
DeliveryThe script and beacon endpoint are served from CloudFront edge locations worldwide. Beacons are sent in the background, when the browser is idle or the page is closing, so the distance to London never slows your visitors down.
Page-level data30 days (Free), 25 months (Standard), 37 months (Business)
Deep diagnostics7 days (Free), 90 days (Standard), 13 months (Business)
Your dataYours. Raw export to your own S3 bucket on Business (being built).
This websiteclickvitals.com is static pages served by Cloudflare Pages. It sets no cookies and runs no analytics; the only script measures the page you're reading, in your browser, and sends nothing. Cloudflare handles the connection, as any CDN does. The dashboard and data endpoints are separate, on AWS (above).