Data Policy

The short version

Ometra is privacy-first by design. We do not use cookies, we do not store IP addresses, we do not generate persistent identifiers, and we do not track visitors across websites or devices. All metrics are aggregated, and no data is ever sold or used for advertising.

What we collect

For each pageview or custom event on a site that uses Ometra, we may record:

• The page URL and page title, and the referrer (where the visit came from)
• UTM campaign parameters, if present in the URL
• Browser, operating system, and device type (from the User-Agent)
• Approximate location — country, region, and city — derived from the IP address
• Custom event names, their properties, and revenue values that the site owner chooses to send
• Scroll depth, and — where the site owner enables heatmaps — the aggregate position of clicks on the page (as coordinates, not tied to any individual)

What we do not collect

• No cookies or other data stored on the visitor's device
• No stored IP addresses
• No persistent identifiers, and no device fingerprinting
• No cross-site or cross-device tracking or profiles
• No session recordings, mouse-movement capture, or keystroke logging
• No personal data of the kind that would let us, or the site owner, identify an individual visitor

How we count unique visitors

To count unique visitors without cookies or identifiers, we generate a one-way hash from the visitor's IP address, User-Agent, the website being visited, and a secret “salt” that rotates every 24 hours. The old salt is discarded when it rotates, which means:

• The hash cannot be reversed to recover the IP address or identify a person
• The same visitor cannot be linked from one day to the next
• The same visitor cannot be linked across different websites

This gives site owners an accurate daily visitor count while making long-term or cross-site tracking impossible by design.

IP addresses

A visitor's IP address is used transiently — only to generate the daily hash above and to derive an approximate location (country, region, city). It is never written to our database and never stored in logs beyond what is technically required to process the request.

Heatmaps

When a site owner turns on heatmaps, Ometra records the aggregate position of clicks (as normalized coordinates) and how far visitors scroll. This data is aggregate-only and is not linked to any individual visitor — there is no session recording. If the site owner enables page screenshots as a backdrop, those screenshots are of their own public pages and are captured by our screenshot provider; they are not visitor data.

Is this personal data?

Because Ometra does not collect personal data or use cookies or similar device storage, most websites using Ometra will not need a cookie consent banner for our analytics. That said, privacy law is fact-specific and this document is not legal advice — please confirm your obligations with your own advisor.

Who owns the data

The site owner (our customer) owns their analytics data. We act only as their processor: we don't sell it, share it with ad networks, or use it for any purpose other than providing the service. Customers can export their data and can ask us to delete it. See our Data Processing Agreement for the details of that relationship.

Where data is stored

Analytics data is stored on Canadian infrastructure. It is not shipped off to US ad networks. Some supporting services we rely on are listed in our Privacy Policy and DPA.

Respecting visitor choices

Our script honors the browser's Do Not Track signal and the Global Privacy Control. We also filter out known bots, crawlers, and headless traffic so that reported numbers reflect real people.

We use Ometra too

We measure our own website with Ometra, under exactly the same rules described here.

Questions

Email us at [email protected].