# Privacy and cookieless mode

twelvebit collects what you need to see traffic and revenue, and nothing more. This page says exactly what is collected and stored, so you can write an accurate privacy policy.

## What the script sends

For each page view, goal or outbound click: the page URL, the referrer (first page view only), the viewport width, the event name and props, and the visitor and session ids from the cookies. The browser also sends its user agent and IP address with the request, as every request does.

## What twelvebit stores

| Data | Stored | Notes |
|---|---|---|
| Page path, hostname, referrer domain and URL, UTM and `ref` parameters | yes | Query strings other than UTM and `ref`/`via`/`source` are not stored. |
| Country, region, city, approximate coordinates | yes | From the network edge in front of twelvebit, based on the IP address. |
| Browser, operating system, device type, screen width | yes | Parsed from the user agent. The full user agent is not stored. |
| IP address | **no** | Used during the request for IP exclusions and, in cookieless mode, for the daily hash. Then discarded. |
| Visitor id and session id | yes | Random values from the cookies, or the daily hash in cookieless mode. |
| Goals and their props | yes | Whatever you send. Do not send personal data in props. |
| Identity (user id, email, name, image, traits) | only when you call identify | See [Identify](/docs/identify). |
| Payments | yes, from your payment provider | Amount, currency, plan, customer id, email when the provider sends it. |

## Cookies

| Name | Lifetime | Purpose |
|---|---|---|
| `_tb_vid` | 1 year | Recognise a returning browser, and link a payment to its visits |
| `_tb_sid` | 30 minutes, renewed with each event | Group page views into one visit |

Both are first-party cookies on your domain (on `.example.com` when you set `data-domain`). twelvebit sets no third-party cookies and does not track people across sites.

## Cookieless mode

Turn it on in the site settings and add `data-cookieless="true"` to the script tag:

~~~html
<script defer data-website-id="tb_YOUR_SITE_ID" data-domain="example.com" data-cookieless="true" src="https://twelvebit.app/js/script.js"></script>
~~~

- The script sets no cookies and uses no storage.
- The server makes the visitor id from a hash of the IP address, the user agent, the site and a secret salt that changes every day (UTC). The IP address is not stored.
- A visit continues while the same visitor sends events at least every 30 minutes.
- When the site setting is on, the server uses the hash even if a browser sends cookie ids.

What you lose:

- The same person is a new visitor every day, so returning visitors and multi-day journeys are not counted.
- [Identify](/docs/identify) links only that day's visitor.
- Revenue attribution has no cookies to read at checkout. It works when the visitor [identified](/docs/identify) with the same email before paying, and the provider sends that email with the payment. Expect fewer attributed payments.
- People on the same network with the same browser version on the same day can count as one visitor.

## Exclude yourself

In the browser that you want to exclude, open the developer console on your site and run:

~~~js
localStorage.setItem("twelvebit_ignore", "true");
~~~

To count this browser again: `localStorage.removeItem("twelvebit_ignore")`.

For whole offices or test servers, use the site's exclusions in the dashboard: IP addresses, paths (`/admin/*`, `**` for any depth), hostnames and countries. Excluded requests are dropped before anything is stored.

## Local development

The script does not track on `localhost`, `127.*`, `[::1]`, `*.local` or `*.test`. Add `data-allow-localhost="true"` for a short local test, and remove it again.

## Do Not Track and Global Privacy Control

The script does not read the Do Not Track or Global Privacy Control signals. If your policy respects them, load the script only when they are off:

~~~html
<script>
  if (navigator.doNotTrack !== "1" && !navigator.globalPrivacyControl) {
    var s = document.createElement("script");
    s.defer = true;
    s.src = "https://twelvebit.app/js/script.js";
    s.setAttribute("data-website-id", "tb_YOUR_SITE_ID");
    s.setAttribute("data-domain", "example.com");
    document.head.appendChild(s);
  }
</script>
~~~

## Consent

Whether you need consent depends on the laws that apply to you and on how you use the data. In cookie mode the script stores an identifier on the device for up to one year. In the EU and the UK, storing identifiers on a device usually needs consent unless an exemption applies. Cookieless mode stores nothing on the device. If you are not sure, ask a lawyer. This page is a description of the product, not legal advice.

---

Source: https://twelvebit.app/docs/privacy · All docs: https://twelvebit.app/llms.txt