Legal

Privacy policy

What we collect, what we don't, and where the data lives.

The short answer

Vitrus sets no cookies, mints no persistent identifier and stores no personal data about your visitors. The visitor id is a one-way hash that changes every day. Where a site owner chooses to send the ids of their signed-in users, those arrive already hashed and are stored only as a second hash (see below).

Visitor data (people who visit your site)

What we collect

• Page path, page title, referrer and UTM parameters
• Browser, operating system, device type, screen size, language
• Country — only from your proxy's header (Cloudflare and similar)
• Core Web Vitals (LCP, INP, CLS, FCP, TTFB) from real visits
• JavaScript error messages, file and line — never stack traces
• Custom events you define, and their properties
• Derived visitor and session digests

What we never collect

• Cookies and localStorage — not used at all
• IP addresses — never stored; only an input to a one-way hash
• Values typed into forms — only the field name is sent
• Password and hidden fields — never observed
• Session recordings — unless the site owner switches session replay on (see below)
• Heatmaps — nothing extra is collected for them: they are drawn from the session recordings above, only where a site owner has switched replay on
• Person or company identification — out of scope

Session recordings (only where a site owner enables them)

Session replay is off by default. It records only on a site whose owner switched it on and whose page opted in with the data-replay attribute. When it records, it collects:

• The structure and styling of the page, with every text node masked (each character replaced by *) unless the site owner marked an element as public
• Input, textarea and select values — always masked, never recorded as typed
• Pointer position, clicks, scroll position, window size and the page path
• Browser, OS, device type and — if the proxy provides it — country, as for pageviews

It never captures password fields, credit-card fields, one-time codes or anything the site owner marked with data-vitrus-block; those are recorded as an empty grey box. Visitors who send Do Not Track or Global Privacy Control are never recorded. Recording sets no cookie and stores nothing in the browser; the IP address is not stored. Recordings are deleted after the retention the site owner chose (30 days by default, at most 90), and a site owner can delete any recording at any time. Sites in strict privacy mode cannot enable replay.

How the visitor id is built

hash(secret_salt + day + site + ip_prefix + browser)

The salt rotates daily, so the same visitor hashes to a different value tomorrow. Retroactive identity stitching is not possible. IPv6 addresses are reduced to their /64 prefix — that identifies a network, not a device.

Signed-in users (only where a site owner calls identify)

A site or app owner may tell Vitrus which of their own users is signed in, so that they can count new, returning, lost and paying users. When they do:

• The user id is hashed before it leaves the browser or the device (sha256(site + id)), and the server hashes that again with a secret. Only the second hash is stored; the raw id never is.
• The hash is per site: the same person signed in to two sites cannot be joined, by the site owner or by us.
• Properties sent with it that look personal — keys such as email, phone, name or address, and values shaped like an email address or a phone number — are dropped in the browser and again on the server. A plan label (for example "pro") is kept.
• The dashboard shows each such user under a generated name, never an email address or a real name.

This is pseudonymous data: the site owner, who holds the original ids, could match a hash to a person in their own system. That is why it exists only where the owner chose to send it, and why strict mode ignores it.

Mobile apps (Swift and Flutter SDKs)

An app using the Vitrus SDK sends screen names, the events the app owner defines and their properties, the app version, and a user-agent naming the SDK, the device class (phone, tablet or desktop), the operating system and its version. Signed-in users are handled exactly as above, hashed on the device.

• No device identifier. No advertising identifier (IDFA / Android advertising id), no vendor or install id. A random value that the SDK replaces every UTC day stands in for the visitor, so the same device cannot be followed from one day to the next.
• The SDK keeps that daily value and a queue of not-yet-sent events (at most a day old) in the app's own storage on the device, and nothing else. Uninstalling the app removes both.
• The IP address is not used to build the visitor id and is not stored; country comes only from the hosting proxy's header, as for websites.
• The Swift package declares no tracking in Apple's privacy manifest (NSPrivacyTracking is false) and needs no App Tracking Transparency prompt.

Strict privacy mode

Each site can be switched to strict mode, which drops country, screen size, referrer query strings and cross-day identity entirely, and refuses any Do Not Track override. It is enforced on the server, so the browser script cannot bypass it.

Do Not Track

If the browser sends DNT, nothing is collected by default. A site owner can disable that with data-do-not-track="false", in which case the responsibility is theirs — except in strict mode, where the override is refused.

Account data (Vitrus users)

• Email address and, if you gave one, your name
• Your provider user id, if you signed in with Google or GitHub
• Session records (login time, browser)
• Billing status — card details never reach us, they stay with the payment provider

Where the data lives

In the cloud version, data is held on our servers in Germany/Finland (Hetzner). If you run it yourself, the data is yours and nothing is sent to us.

Third parties

Your rights and retention

To delete your account and data, write to us; we action requests within 30 days. Retention length depends on your plan (pricing).