The tracking script never touches document.cookie, under any regime and for any visitor. What it may hold on a device is one first-party identifier for your site alone — and only where the rules below allow it.
What we collect
| Data | Kept as |
|---|---|
| Page | The path, without its query string. |
| Referrer | The referring host, never the full URL. |
| Campaign | The UTM fields, and the name of a click-ID parameter, never its value. |
| Country | Derived from the address in memory. The raw IP is never stored. |
| Device | A class — desktop, mobile or tablet — plus browser and operating-system family. The full user-agent string is discarded after classification. |
| Your events | The names and properties you chose to send, after the scrub described in Custom events. |
What we never collect
- A cookie, under any regime.
- A device fingerprint, a cross-site identifier or an advertising id.
- A raw IP address in storage — it is used for a moment to derive a coarse country and then discarded.
- A precise location. City is possible only behind two separate switches, one held by the operator and one by the project.
How a visitor is counted
The tracker writes nothing to a visitor's device — no cookie, no
localStorage — until the regime, or consent, allows it. Every page
load starts stateless: the first batch carries no ids, and the
server counts the visitor with a keyed hash that changes every day. The
server then tells the tracker which regime this visitor gets.
You choose the regime per project, on the project's Settings page under Privacy:
| Regime | Who gets it | What the tracker does |
|---|---|---|
| Automatic (default) | decided per visitor by country | Strict for visitors in the EEA, the United Kingdom and Switzerland, and for visitors whose country is unknown; Opt-out for everyone else |
| Strict | everyone | stays stateless until your banner, Google Consent Mode or a TCF CMP grants storage. A returning visitor is a new unique the next day: that is the price of storing nothing |
| Opt-out | everyone | stores a first-party id by default; honors Global Privacy Control, Do Not Track and optout() |
Two things hold in every regime: a browser that sends Global Privacy Control or Do Not Track is never given a stored id (an explicit consent from your banner wins over the signal, as the GPC specification allows), and nothing is ever shared across sites.
Consent modes
The tracker starts in stateless. Your banner, or one of the bridges
below, moves it:
anonymous— the device may hold a first-party id.identified— the same, plusidentify()may attach your user id.stateless— withdraw: the stored ids are removed and the tracker goes back to the daily hash.pending— hold every event in memory (up to 100) until one of the others arrives. Nothing is sent while pending.
Under the Opt-out regime the tracker reaches anonymous by itself
after the first answer from the server; under Strict it waits.
Google Consent Mode v2 and TCF v2.2 — no glue code
If your site already runs a consent banner for Google tags, nothing
more is needed: the tracker reads every consent command on the
dataLayer (analytics_storage: "granted" allows the device,
"denied" withdraws) — the ones already there and every one pushed
later. A TCF v2.2 CMP is followed the same way through __tcfapi:
Purpose 1 ("store and/or access information on a device") granted
allows the device, refused withdraws. A bridge never lowers an
identified you granted by hand.
window.sightglass.consent("pending");Resolve the state to anonymous or identified. The tracker releases held events under the selected mode, with ids now that the device may hold them.
window.sightglass.consent("identified");window.sightglass.identify("user_12345678");Call identify only after identified consent. A user ID contains 8 through 64 letters, digits, underscores, or hyphens.
The server refuses pending events. This rule makes a tracker error visible instead of storing data without resolved consent.
The visitor's own kill switch
The sg_optout local storage value is the persistent browser kill switch. It is the ONE key the tracker reads before consent, because it exists only to stop the tracker. optout() also removes every id the tracker ever stored.
window.sightglass.optout();This call sets sg_optout to 1. It also clears the current memory queues.
You can set the value before the tracker loads.
localStorage.setItem("sg_optout", "1");The public API does not include an opt-in call. Remove the local storage value and reload to start collection again.
Do I need a consent banner?
This is not legal advice, and we are not able to give any. Many site owners find that measurement which stores nothing on a device does not need a consent banner where they operate. The answer depends on where you and your visitors are, and on everything else your site does. Ask your own adviser — and describe DataVisitors in your privacy notice either way.
What we can tell you is exactly what happens, which is the part above: nothing reaches a visitor's device until the project's regime or the visitor's consent allows it, and the daily key that counts a stateless visit is replaced every day and cannot be recovered afterwards.
See also Data and hosting for where the data lives and how long it stays, and Data removal for erasing a person you identified yourself.