Docs

Privacy

What the tracker keeps, what it sends, and what it removes in the browser before anything is sent. Everything here describes the script’s actual behaviour.

What’s stored in the browser

The tracker doesn’t set cookies. It keeps a few random IDs in the browser’s own storage, which is separate for every hostname:

Key	Where	Holds
`ccp`	localStorage	A random anonymous ID for this browser.
`cci`	localStorage	The ID you passed to identify, if you called it.
`_cc_cap`	localStorage	Markers for heatmap captures already taken, so the same page isn’t captured again.
`ccs`	sessionStorage	A random session ID.
`ccl`	sessionStorage	When the session was last active. A session ends after 30 minutes without activity.

What’s sent

Autocaptured events. Pageviews with the page path and, on the first one, the referrer; clicks with the element’s tag, id, first two classes, a short selector, the click position and viewport width; scroll depth. The full list is in Events.
Your own events and identify calls, with the properties you pass.
With every event, the anonymous ID, the session ID, and the identified ID if you set one.
On links between your listed domains, a _ccid parameter with the anonymous ID and session ID, so the next domain can recognise the visitor. See Domains and identity.

On arrival, ClickClacks adds the visitor’s country and the browser, operating system and device type read from the user agent. The IP address isn’t stored: that’s a per-source setting, and it is off unless you turn it on. Requests from well-known crawlers, such as Googlebot, Bingbot and link-preview bots, are dropped by default.

Sensitive URL parameters

Page paths and referrers keep their query string by default, because that’s where UTM tags live. Before anything is sent, the tracker removes every query parameter whose name matches, ignoring case:

code
password
passwd
pwd
auth
authorization
session
sessionid
sid
signature
sig
otp
apikey
email
phone
ssn
card
cvv

It also removes token, key and secret, and any name ending in one of them after an underscore or hyphen, such as access_token, api_key or client-secret. The #fragment is never sent with page paths.

what the tracker sends

https://acme.com/welcome?utm_source=newsletter&email=ana@acme.com&reset_token=9f2c
                                      ↓
/welcome?utm_source=newsletter

To drop the query string from page paths entirely, add data-query="off" to the script tag. Scrubbing only changes what is sent to ClickClacks, never the URLs on your site.

Click text and masking

A click on a link or button records up to 40 characters of its visible text. Other elements record no text. No text is recorded when the click happens inside:

input, textarea or password fields
anything contenteditable
any element marked data-cc-mask, or inside one

Add data-cc-mask to anything whose text you never want recorded, such as account details. It also removes that part of the page from heatmap captures.

html

<!-- Left out of heatmap captures, and no click text is recorded inside it -->
<section data-cc-mask>
  <h2>Your invoices</h2>
  …
</section>

Heatmap page captures

To draw heatmaps, the tracker occasionally captures what a page looks like and sends it to ClickClacks. Captures are on by default for each source. You can turn them off for a source in the app, or for a site by adding data-capture="off" to the script tag. The capture is redacted in the browser, before it is sent:

Form fields (input, textarea, select, contenteditable) and embedded content (iframe, video, canvas, object, embed) are replaced by plain grey blocks.
Anything marked data-cc-mask or data-private, plus any selectors you add to the source’s skip list, is replaced the same way.
In the remaining text, every digit and anything that looks like an email address is replaced with dots.
value, placeholder, title and alt attributes, and inline event handlers, are removed.
If the whole page is marked private, nothing is captured.

Other page text and images are still visible in the capture. Mark anything personal with data-cc-mask.

Opting a visitor out

// When a visitor declines or withdraws consent
window.clickclacks('optOut')

// If they later agree, without a page reload
window.clickclacks('optIn')

optOut drops any events not yet sent, deletes the tracker’s IDs from both local and session storage, and stops all tracking on the page. optIn resumes tracking with brand-new IDs, created on the next event. Both also exist as window.clickclacks.optOut() and window.clickclacks.optIn(). Neither can recall events that were already sent.

Opt-out lasts for the current page load

The tracker doesn’t remember an opt-out itself. On every page load for a visitor who has opted out, call optOut again, for example from your consent tool. To make sure not even the first pageview is sent, queue the call with the stub above the script tag: queued calls run before the first pageview.

On sign-out, use reset instead: it forgets the identified person but keeps tracking.

What isn’t scrubbed

The tracker is careful, but it can’t know what your URLs and events mean. It does not:

inspect or redact path segments, such as /users/ana@acme.com;
redact values under parameter names that aren’t on the list above;
check the properties you send with custom events or identify;
hide link or button text outside a masked area.

Keep personal data out of paths and event properties, and use data-cc-mask where labels themselves are personal.