Data Privacy at Metryo

01What a pageview carries

Site ID, page path, referrer, UTM parameters, country (derived server-side), device type, browser and major version, operating system and major version, device model where the browser reports one, screen size, network operator, connection type, the browser's own connection-speed class and the primary language from the Accept-Language header. Custom events and clicks additionally carry an event name and the properties you attach, described in the next section.

Every event also carries a timestamp, the hashed visitor identifier described below, a session identifier that groups a visit together, whether the visitor was new to your site, and the traffic-quality verdict. Those five are what make visitor counts, sessions, bounce rate and bot filtering possible.

Every one of those is either already present in the request or a value the browser volunteers. We do not read anything that requires probing the device: no canvas, font or audio measurement, no CPU or memory counters, no timezone lookup.

02What a tracked click carries

Click tracking is a paid-plan capability and covers three cases: an element you marked with a data-metryo-event attribute, a link pointing at another hostname, and a link pointing at a downloadable file. Nothing else on the page is instrumented.

A marked element sends the name you gave it plus any data-metryo-prop-* values you added, so you decide exactly what is recorded. An outbound link sends the destination hostname, the destination URL and the link's visible text. A download sends the file name. Every click also carries the same context as a pageview, because it is stored as an event on the same document.

There is no session recording and no heatmap. The script does not read keystrokes, input or textarea values, clipboard contents, mouse coordinates, scroll position, or the text of the page outside the label of a link that was clicked. Elements carrying a data-metryo-ignore attribute are skipped, in-page anchors are skipped, and mailto: and tel: links are skipped.

03How visitors are counted

We compute a visitor identifier as a salted hash of the visitor's IP address and user agent, scoped per site. The salt rotates monthly, which makes long-term tracking impossible while keeping unique-visitor counts accurate. The raw IP and user agent are not stored alongside analytics events.

04No cookies, no fingerprinting

The script sets no cookies and no localStorage identifiers. It does not use canvas, font or audio fingerprinting. In most jurisdictions this means no consent banner is required for basic measurement — though that determination is yours to make for your own site.

05Traffic-quality signals

Crawlers are identified by name from their user agent, so AI agents, search engines, SEO tools and uptime monitors are reported separately rather than lumped together. Datacenter, VPN and relay traffic is inferred from the network operator that owns the address block, and Tor is matched against the Tor project's public exit-node list — as aggregate signals, never as individual profiles.

These lookups run against databases held on our own servers, so no visitor IP address is ever sent to a geolocation or IP-intelligence service. Geolocation data is provided by DB-IP (db-ip.com) under the Creative Commons Attribution 4.0 licence.

06Retention and deletion

Events past your plan's retention window are cleared by a periodic sweep rather than on an exact schedule, so one can briefly outlive its window. Deletion a site owner asks for is immediate: clearing a site's data, deleting a site or deleting an account all take effect straight away, and deletion is physical removal from the database rather than a soft hide.

Before deleting anything you can export it: every plan can download the raw events for any date range as a CSV. It is the stored data itself rather than a summary — one row per event, carrying the fields listed above including the hashed visitor and session identifiers.

07What we never do

No selling of data. No advertising profiles. No cross-site tracking. No sharing with third parties beyond the infrastructure sub-processors needed to run the service.

Questions about anything on this page? Email privacy@metryo.io.