Privacy.

Orb is cookieless. It does not fingerprint devices, does not follow people between websites, and does not build advertising profiles. It is built for aggregate, statistical analytics that help a site owner understand and improve their own website.

Pages

The path and title of pages viewed. Query strings are not stored, apart from campaign tags.

Referrer

The site and page that linked to the visit, without its query string.

Campaigns

UTM tags (source, medium, campaign, content, term), and which kind of ad click id was present (for example gclid). The click id value itself is not stored.

Device

Device category, browser and operating system, worked out from the user agent. The full user agent string is not stored.

Location

Country only, from the request. City and precise location are not collected.

Language

The browser's primary language, for example "en".

Engagement

How long a page was visible and whether the visitor scrolled past 25%, 50%, 75% and 90%.

Interactions

That a form was submitted and what kind of form it appears to be (for example signup or contact), clicks on links to other websites, file downloads, and clicks on email or phone links. Never what was typed, and never the email address or phone number.

Likely conversions

Signals that a purchase, signup or enquiry probably completed, such as reaching an order confirmation page. If the page exposes an order total or order number in structured data, it is recorded as an unverified estimate.

Site events

Events the website chooses to send with orb.track(), including any properties the website includes.

Cookies

None. Orb does not set cookies.

Browser storage

No identifiers in localStorage, sessionStorage or IndexedDB. The only exception is an opt-out preference, described below.

Fingerprinting

No canvas, font, audio or hardware probing, and no combining device details to recognise a browser.

Form contents

No field values, keystrokes, mouse movements, session recordings or heatmaps.

Cross-site tracking

No identifiers that follow a person from one website to another.

Advertising

No advertising or remarketing profiles. Analytics data is not sold or used for unrelated advertising.

Raw IP addresses

Not stored. See how IP addresses are handled below.

To count visits without cookies, Orb works out a daily visitor code on its server: a one-way hash of a random salt, the website, the IP address and the user agent. The salt is replaced every day and the old one is deleted.

That means the same person visiting tomorrow counts as a new visitor, the code cannot be turned back into an IP address, and because the website is part of the hash, it cannot be used to connect visits across different websites. A session ends after 30 minutes without activity.

The IP address of each request is used briefly while it is processed: to work out the country and to calculate the daily visitor code.Orb does not write raw IP addresses to its analytics database.

Like any web service, the hosting infrastructure Orb runs on may process IP addresses in short-lived operational and security logs.

Visitors whose browser sends a Global Privacy Control signal are not tracked. Websites can also respect Do Not Track, which is switched on by default for new sites.

Any website using Orb can offer an opt-out control. For example, in its privacy policy:

<button type="button" data-orb-opt-out>Opt out of analytics</button>
<button type="button" data-orb-opt-in>Opt back in</button>
<span data-orb-status></span>

Or from JavaScript with orb.optOut() and orb.optIn(). Opting out saves a single preference, orb_opt_out, in that browser for that website so the choice is remembered. It contains no identifier.

Analytics data is kept for 12 months and then deleted. Site owners can export their data or delete a site or their whole account at any time, which removes its analytics data.

Orb is designed to keep analytics privacy-friendly, but you remain responsible for your own privacy notice and for complying with the laws that apply to you and your visitors. Whether you need consent can depend on your location, your visitors' locations and how you use the data. This page is not legal advice.

We suggest mentioning Orb in your privacy policy, linking to this page, and offering the opt-out control above. If you decide you need consent before any analytics runs, add data-consent="required" to the script and call orb.consent(true) once a visitor agrees.

Back to Orb