We do not store raw visitor IP addresses. They are hashed with a secret salt that changes every night, so the same visitor produces a different value tomorrow and cannot be followed across days.
We do not store your raw logs. Each line is classified and discarded in the same pass. There is no archive to breach.
We do not fingerprint devices. No canvas, no WebGL, no audio fingerprinting. The behaviour snippet measures timing and geometry.
By default we set no cookie on your visitors. There is one optional setting that does, it is off unless you turn it on, and the interface tells you what turning it on means before you do.
When your server or edge tells us about a request, we receive the visitor's IP address, user agent, the path requested, response status and size, referrer, protocol, TLS details, and the request headers. This is the same information already sitting in your own access log.
We use it to work out what the visitor is, then we throw the raw line away. What we keep is the verdict and the summary: which tier, how many requests, which paths, which network, how confident we are, and which signals fired.
A plaintext IP address is stored in exactly one place: cb.waf_candidates,
used to suggest blocking rules. A block rule needs a real address, so there is
no way around it. That table has a 48 hour automatic expiry and
holds only traffic classified as rogue.
Sessions are keyed on hash(ip + user agent + site + daily salt). The salt
is secret and rotates every night. The consequence is deliberate: the same
person visiting today and tomorrow produces two unrelated keys, and there is no
way to link them, including for us.
This is why your visitors need no cookie banner on our account. It is also why we cannot offer returning visitor analytics by default, and we would rather say that plainly than imply a capability we deliberately gave up.
The optional snippet measures how a page was used, so we can tell a person who read it from a browser that rendered it and did nothing. It records:
| What | What that means |
|---|---|
| Pointer travel and direction change | Total distance and how often direction changed. Not a path or a coordinate trail. |
| Scroll depth and variance | How far down, and whether it accelerated the way momentum does. |
| Click timing | Milliseconds between pressing and releasing. Not what was clicked. |
| Typing rhythm | Variance in the gaps between keystrokes. Never keycodes and never characters. The signal cannot tell an A from a Z. |
| Focus time | How long the tab was focused. |
| Environment | Screen size, pixel ratio, timezone, language, whether the browser reports being automated. |
Those environment values are checked for internal consistency and then discarded. No device identity is constructed from them. We deliberately do not touch canvas or WebGL: privacy browsers randomise both anyway, and the signal is not worth the alarm it causes.
If a visitor blocks the snippet, they are still counted. Their visit was already recorded from the server log. They are classified as Human (Privacy Mode) and appear in your numbers. Blocking it costs behavioural detail, never the visitor.
There is a per site setting called visitor identity. It is off by default. Turning it on sets a first party cookie on your domain containing a random value, which lets us recognise a returning browser.
The value is random, never derived from the device. A derived identifier would be a fingerprint wearing a cookie's clothing, and we would be claiming a privacy property we did not have.
If you turn this on, the cookie is on your domain and consent becomes your obligation to your visitors under GDPR, ePrivacy and similar law. The setting says so before you enable it.
We do not sell data, and we do not share visitor data with advertisers.
If you switch on sharing for a site, that site contributes to aggregate benchmarks. What is contributed: the percentage of your traffic that is real people, your conversion rate, and your category. Never your domain, your visitors, your pages, or anything identifying you to another customer. A category with fewer than three participating sites is suppressed entirely, because an aggregate of two is not an aggregate.
| Who | What they get |
|---|---|
| MaxMind | Nothing. The network database runs locally on our server, so no visitor address leaves it. |
| DataForSEO | Domain names only, for authority scores. No visitor data. |
| Google (Gemini) | Aggregated summaries only, for AI narration, and only for accounts on a plan that includes it. Never raw logs and never visitor data. |
| PayPal | What is needed to process a payment. We never see your card details. |
| What | How long |
|---|---|
| Raw log lines | Not stored at all. Classified and discarded in the same pass. |
| Session records | Your plan's retention window, from 7 to 180 days. |
| Daily aggregates | Two years. |
| Plaintext IPs in blocking suggestions | 48 hours, automatically. |
| Your account and billing records | While your account exists, then as long as tax law requires. |
You can export or delete your account data at any time from your settings, or by emailing us.
For your visitors, the honest position is this: because addresses are hashed with a nightly rotating salt, we usually cannot locate an individual visitor's records even when asked to. There is no identifier to search on. If a visitor contacts you about data we hold, tell us the site and the date and we will do what can be done, but the design that protects them also limits what we can retrieve.
If you have turned on visitor identity, that changes: those records can be located by the cookie value, and we can delete them on request.
If any of this changes we update this page and the date at the top. Where a change materially affects what we collect, we will email account holders rather than relying on you noticing.
Privacy questions go to privacy@clickbaton.com and are answered by a person.