Privacy and consent
What is collected and what never is, GPC and DNT handling, the consent API, and cookie banners.
The short version
The tracker sets no cookies, stores no identifier for the visitor on their device, never keeps a raw IP address, and counts visitors with a keyed hash that expires at UTC midnight and differs on every site. What it does keep in the browser is four short-lived technical values, and data-storage="none" removes even those. These are design properties of the software, not policies; the full construction, with every exception named, is in the Privacy Policy.
- A per-tab session hint.
- An offline queue for events that failed to send.
- The consent state.
- A five-minute cache of your site's configuration.
Opt-out signals
GPC is enforced on both ends
The consent API
Most sites need no banner for measurement with this tracker: it is first-party, aggregate, never combined across sites and never shared onward. Two features go beyond that, identify and attributed revenue, which link a visitor to a person or an order. Your code calls those, so the consent question for them is yours; the script gives you the hook rather than deciding for you.
Gate collection, if your legal position wants it
To collect nothing until consent is granted, add the attribute:
<script
async
src="https://c.getopen.so/oa.js"
data-key="YOUR_TRACKING_KEY"
data-collector="https://c.getopen.so"
data-require-consent="true"
></script>Wire your banner to the decision
oa.consent("granted");- With data-require-consent, nothing is collected until granted.
- Denied is final for that visitor regardless of any other setting, and the choice persists in localStorage on their device, or for the page only in strict mode.
- Every signal the script could send passes through one decision point; there is no path around it.
- With attributed revenue off, no payment is linked to a visitor at all: no order_id is sent, one that arrives anyway is dropped on the server, and the matcher skips the site, including the routes that come from your own payment integration rather than a browser.
What your own privacy policy can say
Where data lives
All analytics data is stored and processed in the European Union (Helsinki, Finland) and does not leave that infrastructure. Country and city come from a database file on our own servers; no IP address is ever sent to a geolocation service. The full subprocessor list is in the Privacy Policy.