Privacy & Data Collection

Pulse is designed to be compliant with privacy regulations by default. The tracking script collects only what is necessary to produce analytics and stores nothing that can identify an individual — no name, no email, no account, and no identifier that survives a calendar month or reaches another website.

What Pulse never does

• Sets cookies or uses localStorage to track visitors
• Fingerprints browsers using canvas, WebGL, fonts, or similar techniques
• Stores raw IP addresses
• Collects names, emails, or any personal data
• Tracks visitors across different websites

How visitor identity works

Pulse needs to distinguish visitors without cookies. It does this entirely server-side, using two HMAC hashes derived from the same inputs and separated by their salt:

session_id = HMAC-SHA256(daily salt   ‖ domain ‖ IP address ‖ User-Agent)
visitor_id = HMAC-SHA256(monthly salt ‖ domain ‖ IP address ‖ User-Agent)

• The session salt rotates every day, at midnight in your site's timezone. It is what groups a day's pageviews together.
• The visitor salt rotates every calendar month, in the same timezone. It is what makes a reader who comes back on three different days count as one visitor rather than three.

Both are computed at the moment a request arrives and neither can be reversed to recover an IP address. Because the salts differ per site, the same person browsing two Pulse-tracked sites produces two unrelated hashes — there is no way to connect them.

Raw IP addresses are discarded immediately after the hashes are computed and are never written to disk.

Visitor-level views

By default, Pulse shows you your traffic in aggregate. A site owner can switch on visitor-level views, which unlock the Visitors page: the individual readers seen in a range, each visit they made, the pages of that visit in order, and any custom events they fired.

This does not change what Pulse collects. The same columns are written either way. The switch controls whether anyone can read them one reader at a time.

• Off by default, for every site, including existing ones.
• Turned on per site at Settings → Privacy → Visitor views, by an owner or admin.
• Turning it on or off is recorded in your organisation's audit trail.
• What it shows is the monthly hash above, under a generated pseudonym. It carries no personal data, cannot be linked to a person, cannot be linked to the same reader on another site, and stops existing at the end of the month — a returning reader comes back as a new visitor under a new name.
• History begins 26 August 2026. The date picker will not offer earlier days, because earlier rows have no monthly identity.
• Visitor-level data is never exposed on a public share link, in the public read API, in an export, or to Ciphera's internal admin tools.
• It respects your data toggles below: a site collecting country only will not show a city here.

Per-site privacy controls

Go to Settings → Privacy to configure what your site collects.

Data toggles

Each dimension can be turned off independently:

• Page paths — the URL path of each pageview
• Referrers — the referring domain
• Device info — browser, OS, and device type
• Screen resolution — viewport dimensions
• Audience data — country, city, language, and timezone

Geographic granularity

Choose how precisely Pulse records location:

Data retention

How long Pulse keeps individual event records. Options range from 1 month to 3 years, depending on your plan. Aggregated daily statistics (totals, not individual events) are kept permanently regardless of this setting.

Dynamic path grouping

When enabled, Pulse automatically collapses URL segments that look like identifiers — UUIDs, numeric IDs, hashes — into a placeholder. For example, /orders/a1b2c3d4 becomes /orders/:id. This prevents high-cardinality paths from fragmenting your top pages report.

Query parameter allowlist

By default, Pulse strips all query parameters from page paths before recording them. Add parameter names to the allowlist to preserve specific ones — for example, lang or tab. Parameters not on the list are removed.

Browser privacy signals

Pulse respects:

• Do Not Track (navigator.doNotTrack === "1") — no event is sent
• Global Privacy Control (navigator.globalPrivacyControl === true) — no event is sent
• WebDriver — automation is detected and excluded

Privacy policy snippet

Settings → Privacy includes a pre-written snippet you can paste into your site's privacy policy. It describes Pulse's data collection in plain language and is kept up to date as the product changes.