Privacy and security
What ProductLense collects
Every field the script sends, what the server derives from each request, what is never stored, and how long each kind of data is kept.
This page lists every field the ProductLense script sends, what the server adds, and how long each kind of data is kept. The legal terms are in the privacy policy and the DPA.
Fields the script sends
| Field | Example | Purpose |
|---|---|---|
| Site id | 5f0c… | Which site the event belongs to |
| Event name | pageview, Signup | Pages and custom events |
| Page URL | https://example.com/pricing?utm_source=x | Pages and campaigns. Only utm_*, ref, gclid, fbclid and msclkid query parameters are kept; the rest and the #hash are removed in the browser |
| Referrer | https://news.ycombinator.com/ | Source and channel |
| Page title | Pricing | Readable page names |
| Viewport width | 1440 | Screen size |
| Browser language | en-US | Language |
| User id | user_123 | Only after your code calls identify |
| Props | { "plan": "pro" } | Only what your code sends with an event |
| Timestamp | 1733000000000 | Ordering and sessions |
What the server derives
Every HTTP request carries an IP address and a user agent. The server uses them and stores only what is derived:
| Input | Used for | Stored |
|---|---|---|
| IP address | Visitor hash, country | No. Only the hash and the two-letter country |
| User agent | Visitor hash, device type, browser, operating system, bot filter | No. Only device, browser and OS names |
| Referrer | Referrer domain and channel | The referrer and its domain, except when it is your own site |
Mobile apps
The React Native and Flutter SDKs send the screen name, goals and identify calls, plus the app's bundle id, the platform (iOS or Android), the window size and the language. On first launch they create a random install id in the app's own storage. It is never the advertising id or any other device identifier. ProductLense stores only a hash of it with the site and app, so an install keeps one visitor until the app is deleted or the user opts out with optOut(). Deep links share only their UTM, ref, via and click-id parameters.
What ProductLense never does
- Never sets cookies.
- Never writes to
localStorageor IndexedDB. Afteridentify, the user id is kept insessionStoragefor that tab only. - Never stores IP addresses.
- Never fingerprints with canvas, fonts, audio or similar techniques.
- Never links a visitor across sites: the site id is part of the hash.
- Never sells data or shares it for advertising.
- Never sends your data to an outside AI model. Ask runs on our own servers: a small open model (EmbeddingGemma 2) beside the database matches your question, and the answer comes from your reports.
Retention
| Data | Kept |
|---|---|
| Raw events and per-visitor sessions | 90 days, then deleted automatically |
| Daily session rollups (bounce rate, duration, entry and exit pages, new vs returning) | For the life of the site |
| Hourly and daily aggregates (counts per page, source, country, device and so on) | For the life of the site |
| First touch per visitor (channel, source, medium, campaign, referrer domain, landing path, country) | For the life of the site, so later payments can be attributed |
| Identities (visitor id and your user id) | For the life of the site |
| Customers, subscriptions and payments from billing connections | For the life of the site |
| Ad spend | Until you delete it, or the site |
| Daily visitor-hash salts | Deleted once older than yesterday |
| Ask questions | 30 days, for abuse review |
| Ask's index of your page, source and campaign names (numbers that let it recognise them) | Rebuilt daily; deleted with the site |
Deleting a site deletes its data; see Export and deletion and Data retention.
Where data is stored
The API and databases run on servers at Hetzner in Germany, with Cloudflare in front for TLS, caching of a.js and DDoS protection. See Security practices. A list of subprocessors is available on request; see the privacy policy.