Privacy

Built-in privacy controls and PII filtering that protect tracked data.

PII Filtering

Automatically filters personally identifiable information like emails, phone numbers, SSNs, and credit card numbers from URLs and form data.

Do Not Track

Respects the Do Not Track (DNT) browser setting. When enabled, EventDash will not track users who have DNT enabled.

No consent banner

The script does not set a cookie, so it does not need a consent banner. The anonymous id sits in localStorage. If that key is missing, the same browser hashes back to the same id.

PII Filtering

Automatic filtering of sensitive information

EventDash automatically filters the following types of PII from URLs and form data:

Email addresses
Phone numbers
Social Security Numbers (SSN)
Credit card numbers
Common sensitive URL parameters

Example:

javascript

// Original URL
https://example.com/login?email=user@example.com&token=abc123

// Filtered URL (sent to EventDash)
https://example.com/login?email=[FILTERED]&token=[FILTERED]

Do Not Track Support

Respect user privacy preferences

When a user has Do Not Track enabled in their browser, EventDash will automatically stop tracking. This is enabled by default but can be disabled:

html

<script
  defer
  data-api-key="YOUR_API_KEY"
  src="https://www.eventda.sh/tracker.js"
></script>
<link rel="preload" as="image" href="https://www.eventda.sh/api/crawl?key=YOUR_API_KEY">

<!-- Opt out of DNT (not recommended) -->
<script
  defer
  data-api-key="YOUR_API_KEY"
  data-respect-do-not-track="false"
  src="https://www.eventda.sh/tracker.js"
></script>
<link rel="preload" as="image" href="https://www.eventda.sh/api/crawl?key=YOUR_API_KEY">

Anonymous Session IDs

Privacy-friendly session tracking

The anonymous id is stored as eventdash_anonymous_id. When that key is missing, the script hashes the same signals again:

Language and platform
Timezone, locale, calendar, numbering, and hour cycle
CPU threads, device memory, and touch support
A hash of canvas pixels (text, an emoji, and a gradient)
A hash of the WebGL renderer with the version stripped, plus a tiny triangle

The full user agent and the screen size are still sent, so the dashboard can label browser and device. They are not part of the id. A Chrome update or a second monitor does not mint a new visitor. Clear site data and the session starts over. The anonymous id comes back when those signals match. It is not a name, an email, or a login.

Crawler networks

Who fetched the page, not who visited it

A Next.js middleware report can send the connecting address of a bot-like document fetch. EventDash uses that address once to look up the network owner in a local database and, for a hosting or business network, in the public IP registry (RDAP). The address is then dropped. Stored fields are the ASN, organization, country, and registered network name. Consumer ISP traffic is discarded. The registry lookup sends that address to the regional registry one time per network.

GDPR Compliance

EventDash is designed with GDPR compliance in mind:

No personal data collection by default
Anonymous session tracking
Automatic PII filtering
Do Not Track support
No cookies required
Data minimization principles

What those controls do not promise is in privacy first analytics. The storage definition is cookieless analytics. How to check the localStorage keys in DevTools is cookieless tracking localStorage.