Data we collect
What Loomduct stores about your visitors, and what it never stores.
Loomduct stores only what your reports need. This page lists all of it.
What we store
For every event:
| Data | Example |
|---|---|
| Page address and title | example.com/pricing, "Pricing" |
| Referring site | news.ycombinator.com/item |
| Campaign tags | utm_source=newsletter |
| Type of ad click id | gclid (never its value) |
| Browser, OS and device type | Chrome 129, macOS 15.1, desktop |
| Screen size and language | 1920 × 1080, en-US |
| Country, region and city | Greece, Attica, Athens |
| Time on page and scroll depth | 42 seconds, 80% |
| Visitor id | A daily hash, see How the visitor id is made |
| Session id | A new id for each visit, made from the time it started |
| Custom events and properties | signup with { plan: 'pro' } |
| Page speed | Core Web Vitals, if you turn them on |
For users you identify, Loomduct also stores your user id and the properties you send.
How the visitor id is made
Loomduct makes the visitor id on its servers, for each event, without cookies:
visitor id = hash(IP address + user agent + daily salt)- Daily salt: a random value that goes into the hash (as the key of an HMAC-SHA256), so the id cannot be guessed from the IP address and browser. It is 32 random bytes, made for each project at the start of each day (UTC). It is never derived from anything, so it cannot be rebuilt. It is deleted 4 hours after its day ends.
- IP address and user agent: read from the request, used only for this hash and the location lookup, then thrown away.
- The result is cut to 26 characters.
The same browser on the same day gets the same id, so its visits count as one visitor. The next day, the salt is new, so the same browser gets a new id that cannot be linked to the old one. Each project has its own salt, so one browser has different ids on different sites.
After the salt is deleted, nobody, Loomduct included, can work out which IP address or browser an id came from. More about what this means for your numbers: How Loomduct counts visitors.
What we never store
- IP addresses. Loomduct uses the IP address in memory to find the country, region and city, and to count visitors. It is never saved in a database or in logs.
- The full user agent. Only the browser, OS and device type are kept.
- Query strings. Except for campaign tags and the parameters you choose to keep.
- Ad click id values. Only which one was there.
- Exact locations. No latitude or longitude.
The country, region and city come from a MaxMind database that runs on Loomduct's own servers, so no IP address is sent to MaxMind.
Where and how long
- Analytics data is stored on servers in the EU.
- Data is kept as long as you keep your account. After you close it, it is deleted within 30 days, and from backups within 30 more days.
Read the full privacy policy and the list of subprocessors.