growth analytics/Docs
Open Hey Glancy

Privacy and your data

Hey Glancy is built to collect what you need for product analytics and little else, and gives you the tools to answer deletion requests and keep data only as long as you need it.

What the SDKs collect

  • The events, properties and traits you send.
  • Page and app context: URL, path, title, referrer, UTM parameters, screen size, browser and OS, locale, time zone, app version, device model.
  • An anonymous id and a session id, kept on the device (in the browser, in local storage and a first-party cookie, glancy_anon_id). No third-party cookies, no fingerprinting.
  • Approximate location (country, region, city) derived from the request. The IP address itself isn't stored unless you send it in context.ip.
  • With replay or heatmaps on: the page's structure and interactions, with everything typed into inputs masked.

Common secrets in URLs (token, key, code, password, secret…) are replaced by redacted before anything is sent. Add your own with redactParams (npm) or data-redact-params (script tag).

Traffic from crawlers, uptime monitors and headless browsers is dropped.

Keep personal data out

The easiest personal data to protect is the data you never send:

  • Use your database id as the user id, never an email address.
  • Only pass traits you'll actually use in reports. Hey Glancy doesn't need someone's address to count their orders.
  • Don't put names, emails or free text from forms in event properties.
  • Mask anything sensitive in replays with data-glancy-mask or data-glancy-block (see Session replay).

If you need consent before tracking, wait to load the script or create the client until people agree. If you only need consent for recordings, keep events on and start replay and heatmaps later with startRecording(), or stop them with stopRecording() (see JavaScript).

Removing a person

When someone asks to be forgotten, a bucket admin opens their profile under Users and removes them. There are two ways:

  • Anonymise (the default): their events stay, under a new random id, so your totals and funnels don't change. Their profile, identities and replays are deleted, and their IP, precise location, page URLs and personal event properties (email, name, phone, address and the like) are stripped. Heatmap clicks are kept without any id.
  • Delete everything: their events, profile, anonymous ids, replays and heatmap points are all removed.

Both happen at once and can't be undone. Each bucket can add its own personal property names to strip, in Settings → Buckets → Data and privacy.

Data retention

By default Hey Glancy keeps everything. In Settings → Buckets → Data and privacy, a bucket admin can set how long to keep:

  • events, and
  • replays and heatmaps,

each from 30 days to 2 years, or forever. Older data is deleted every night, along with the profiles of people not seen since the cutoff.

Where data lives

Each bucket's data is stored in its own database, in the region chosen when the bucket was created, separate from every other bucket. Hey Glancy's write keys can only add data; reading it always takes a signed-in account with access to the bucket.