What is collected

CLItrail collects what it needs to connect a visit to an install: pseudonymous identifiers and coarse device facts, never names or contact details of your visitors. This page lists every field, where it comes from and where it is kept.

#From the website

The SDK sends one request per page visit (POST /v1/visits) with:

The page URL and the referrer. The service keeps only their origin and path; query strings and fragments are dropped.
The session source: up to six UTM values of at most 150 characters, the external referrer (origin and path) and the landing time.
The identifiers the page can see, for the providers you enable: GA4 client and session IDs, gclid, wbraid, gbraid, _gcl_aw, Google session attributes, fbclid, _fbp, _fbc, ttclid with its landing time, _ttp, and twclid with its landing time.
Coarse browser details: the low-entropy client hints, the CPU architecture in Chromium browsers, whether the browser is Brave, the number of touch points, the time zone and the language.
Values from your own adapters, if you add any.
gpc: true when the browser sends Global Privacy Control.

Like any HTTP request, it also carries the visitor’s IP address and User-Agent. The IP address is never stored: it counts toward rate limits and, on paid plans with reconstruction on, becomes keyed hashes kept until the reconstruction window ends. From the User-Agent and client hints, the service keeps a browser family and major version, an OS family and a device type on every plan; with reconstruction on, also a keyed hash of the User-Agent, deleted with the network hashes. Google’s session attributes, built on a Google Ads landing, contain the browser’s User-Agent string; they are stored as received so they can be forwarded to Google Ads, and only when the website’s providers include Google Ads.

#In the visitor’s browser

The marker file with the receipt, the tab’s session source, Google’s session attributes and the last TikTok and X clicks’ dates; in handoff mode, nothing. See Browser storage. The SDK sets no cookies.

#From the terminal

The hook reads small files inside browsers’ OPFS folders to find CLItrail markers for your website (other files there are compared with the format, then discarded), plus its own installation ID file. It never reads history, cookies, passwords or Safari’s containers. It sends:

the opaque receipts it found, or a handoff token;
a random installation ID and a random event ID, the event type and the install path ID;
the system (darwin or linux) and the CPU architecture;
which supported browsers have a profile folder, from existence checks only, and the default browser’s family;
the time zone name and the language.

No file paths, user names, host names or command output are sent. See What it sends. The request’s IP address is handled as above.

#On the server

Record	Contents
Visits	The receipt’s SHA-256 hash, page origin and path, referrer, session source, identifiers, the coarse browser, OS and device, GPC flag, timestamps, and, while reconstruction is on, keyed network and browser hashes with the OS family, time zone, language and architecture.
Install events	Installation and event IDs, event type, install path, system, architecture, browser families and default browser, resolution, method, the chosen visit and the journey. On Free: the counts and system fields only. The time zone and language are kept only where attribution runs.
Deliveries	The payload prepared for each destination, its status, attempts and the last error, with secrets removed.
Handoff tokens	The token’s SHA-256 hash, its visit and the installation that used it.
Logs	Every request received and sent, with its exact body, credentials redacted, and receipts, tokens and addresses as keyed hashes. See Logs.
People and organisations	Your Firebase user ID and email address, hashed session tokens, memberships and roles, hashed invitation links, and an activity log without secret values.
Billing	The Stripe customer and subscription IDs, the subscription status and period end. Card details stay with Stripe.
Destinations and log streams	Settings, and credentials encrypted in the separate secret store. See Security and secrets.

No names, email addresses or other contact details of visitors are collected. Receipts and tokens are stored only as hashes, and raw IP addresses are never stored.

#Who receives it

Only the destinations you add, and only after you switch them live. Each destination’s page shows exactly what it receives. Ad platforms never receive a visit made under Global Privacy Control. Google (Firebase Authentication) handles sign-in and Stripe handles payments, as CLItrail’s processors. How long everything is kept is on Retention and deletion. Your visitors can read the service’s privacy notice and the installer page.