Privacy & GDPR
What the tag stores, consent controls, and how PII is handled.
What the tag stores in the browser
| Key | Storage | Purpose | Lifetime |
|---|---|---|---|
signals_did | localStorage + cookie | Anonymous device id | 365 days |
signals_user_did | localStorage + cookie | Identified user id (after identify()) | 365 days |
signals_super_props | localStorage + cookie | UTM/click-id/referrer super properties | 365 days |
signals_opt_out | localStorage + cookie | Opt-out flag | 365 days |
signals_consent | localStorage + cookie | Google Consent Mode v2 decision (ad_storage, analytics_storage, ad_user_data, ad_personalization) | 365 days |
sg_inv_* | localStorage | Per-page inventory content hashes (dedup only) | until cleared |
No third-party cookies are set by PixelFox itself. Vendor tags you enable (Facebook Pixel, TikTok, gtag, Clarity) set their own cookies under their own policies.
Consent controls
- Do-Not-Track is honored by default - browsers sending
DNT: 1are never tracked. signals.optOut()persistently disables all tracking for the browser;signals.optIn()re-enables it. Wire these to your consent banner:
onConsentGranted(() => signals.optIn());
onConsentRevoked(() => signals.optOut());data-signals-no-captureexcludes any DOM subtree (e.g. a support-chat area) from both tracking and auto-discovery.signals.reset()clears the device identity (use on logout of shared devices).
PII handling
- The tag collects no form field contents and no element values beyond visible button/link labels (for auto-discovery).
- Email and phone reach PixelFox only when you pass them (
identify(), server-side purchase events). They are normalized and stored scoped to your site for identity stitching. - Before any ad platform sees them, email/phone/external ids are SHA-256 hashed (Meta's and TikTok's required format). Raw PII is never forwarded.
- Destination credentials (API tokens) are AES-256-GCM encrypted at rest.
Data minimization
PixelFox keeps two event stores, both minimal:
- Daily rollups - counts per event and destination, kept indefinitely.
- Per-event rows - one narrow row per visitor event: event name, visitor id, path, referrer, UTM parameters, device class, whether an identifier was present, the consent state, and the IP truncated before storage (IPv4 to /24, IPv6 to /48). The full property bag is never stored. Rows are deleted after 90 days.
Plus:
- Discovered element metadata - selectors and, for form inputs, their type,
autocomplete, placeholder and label. Never a field's value. - Site-scoped identities - the normalised email and phone passed to
identify()or a server-side purchase, used for identity stitching and shown to you in the visitors list. - Match profiles - per visitor, the SHA-256 hashes of email, phone, name and address
as sent to ad platforms, the
fbp/fbc/ttpbrowser ids, and the client IP and user agent encrypted at rest and deleted after 30 days; the whole profile is deleted after 90 days without activity. Written only for consent-allowed events on online sites.
Deleting a site deletes its keys, definitions, elements, rollups, events, delivery records, identities and match profiles.
Your obligations
PixelFox is a processor for your visitors' data: disclose the tracking (and the
destinations you enable) in your privacy policy, and gate optIn()/optOut() on
consent where your jurisdiction requires it (e.g. ePrivacy/GDPR consent banners).