13Integrations and data

What data is collected

Exactly what the Gauss tracker sends, what is cleaned before sending and before storage, how visitors are counted without cookies, and how long data is kept.

A technical description: which fields leave the browser, what the tracker and the server strip out along the way, how visitors are counted without cookies, and where and how long data is kept. For legal questions, see /legal/visitor-data and /privacy-data.

What the tracker sends

One event is one POST request to https://collect.gausslab.io/api/event with a JSON body of up to 8 KB. Event fields:

Field	Required	What it is
`v`	yes	schema version, `1`
`site`	yes	site ID from the snippet
`name`	yes	event name, such as `page_view`
`page_location`	yes	page URL after cleaning (see below)
`page_referrer`	no	where the visit came from, already trimmed
`page_title`	no	`document.title`, up to 200 characters
`content_group`	no	page category, if the site marks it up itself (Page categories)
`screen_width`	no	window width, used for the device type
`params`	no	event parameters: up to 25 keys, strings up to 100 characters
`items`	no	products, up to 50 entries (Conversions and e-commerce)

This is what a page view looks like in the DevTools Network tab:

json

{
  "v": 1,
  "site": "k3f9x2ab",
  "name": "page_view",
  "page_location": "https://shop.example/blog/how-to-choose?utm_source=telegram&utm_medium=social&utm_campaign=oct_promo",
  "page_referrer": "https://t.me/",
  "page_title": "How to choose a coffee machine",
  "screen_width": 390
}

Nothing else: the tracker doesn't read cookies, localStorage, sessionStorage or IndexedDB, doesn't create identifiers on the device and doesn't use fingerprinting techniques (canvas, WebGL, audio, font detection). The only thing it takes from the browser environment is the window width. You can check this with ?gauss_debug=1; see Verify your installation.

What the tracker cleans before sending

What	Rule
query in `page_location`	only `utm_*` stay; ad click IDs (`gclid`, `yclid`, `fbclid` and others) keep only the name with the value `1`; everything else is removed (UTM tags and click IDs)
`#hash`	removed
external `page_referrer`	origin only: `https://t.me/`
`page_referrer` from your own site	path without query: `https://shop.example/catalog`
forms	only the form's `id`/`name` and the `action` path are read; field values never are
`tel:`, `mailto:` and messenger links	only the contact type is sent, without the number or address

What the server cleans before storage

In page_path, prev_page_path, page_title and string values of params:

What it looks for	Replacement
email address	`[redacted]`
phone number in international format, starting with `+` (10–14 digits)	`[redacted]`
`params` keys such as `email`, `e_mail`, `phone`, `tel`, `name`, `first_name`, `last_name`, `user_id`, `client_id`, `address`, `passport`, `inn`, `snils`	the key is dropped

For example, /user/ivan@mail.ru is stored as /user/[redacted]. Dates, order numbers and other numbers without + are left alone: /blog/2026-10-25/ and /order/1234567890 stay as they are.

Storage contains no IP addresses, user agents, cookies, form field values, phone numbers or email addresses from links, or click ID values. transaction_id is stored only as a hash keyed with a site secret. The full list of stored fields is on /privacy-data.

How to turn off page_title

Coming soon. A site setting to stop sending page titles, for account areas where the title may contain a user's name.

For now, the tracker sends document.title (up to 200 characters) on every page. The server replaces email addresses and phone numbers in the title with [redacted], but it can't detect names this way. If titles of logged-in pages contain names, don't add the snippet to those pages until the setting is available.

How visitors are counted without cookies

We don't store IP addresses or user agents. When an event arrives, they are used to compute an identifier that is valid only for one site and one day (UTC). The key for this calculation is deleted every day, after which the identifier can no longer be linked to an IP address.

The IP address is used only in memory: to compute this identifier, determine the country (and the region, if the site owner turns it on), filter out traffic from data center networks and limit request rates. Then it is discarded. From the user agent, only the browser and its major version, the OS and the device type are kept.

What this means:

visits, paths and funnels are built within one day;
visitors for a period longer than a day are the sum of daily unique visitors.

Where data is stored

The data region is a property of the site. Each region is a separate copy of the collection and storage setup with its own collection address; a site's events never leave its region.
Right now there is one region, the EU. The collect.gausslab.io collection address in the snippet belongs to it.
Accounts and settings are stored separately from events. Reports are built when a user requests them: aggregated numbers leave the site's region, not raw events.

We will name the country where visit data and its backups are stored on /privacy-data before data collection starts. The list of subprocessors is linked from the same page.

How long data is kept

What	Period
Detailed events	3 or 13 months, depending on the site's plan
Daily summaries (main reports)	25 months
Live debug feed	15 minutes

Paths, custom funnels, bounces and single-event inspection are available within the detailed-event period; daily page views, visitors, sources and goals are available for the full summary period. When a site or account is deleted, all its data, including backups, is deleted within 30 days.

Legal questions

Whether you need visitor consent is up to the site owner and their lawyer. A description of the processing for your privacy policy is on /legal/visitor-data, and technical details are on /privacy-data.

Updated October 29, 2026