Privacy & consent
Privacy & consent
Vizoalica avoids collecting sensitive information by default, and the backend enforces it as well as the browser.
Try it
Consent state
What changes (illustrative)
Interact with the demo above.What is and is not collected
| ✓ | Page origin and path (identifiers replaced by :id), route after # |
| ✓ | Click actions: page, safe name, kind, link destination origin and path |
| ✓ | Rage-click bursts as a count |
| ✓ | UTM source, medium, campaign of the landing address |
| ✓ | Custom events you create, with filtered scalar properties |
| ✓ | Consent state, on every event |
| ✗ | Cookies, local storage or session storage (except the opt-in ignore switch) |
| ✗ | Form values, typed text, passwords, payment data, API keys, auth headers |
| ✗ | Raw URL query values, or fragments that are not routes |
| ✗ | Page text, DOM snapshots, heatmaps, click positions, session replay |
| ✗ | IP addresses and user agents (used only in memory to compute a daily hash) |
Unique visitors without cookies
For each event the backend computes a keyed hash of a random value for the current UTC day, the website, the visitor’s IP address and user agent, and stores only that hash. The day’s random value is deleted when the day ends, so nobody can recompute or link hashes afterwards.
- One person on one site on one day is one visitor.
- The same person on two days, or on two sites, counts as two visitors.
Defence in depth
Client-side filtering is a convenience, not a trust boundary: the backend also rejects sensitive-looking payloads before persistence. Whether you need a consent banner depends on the rules that apply to you.