- No cookies, and nothing kept in the browser. No id is stored on the visitor's device.
- Nobody's typing is read. A field is only ever filled or empty. Password, hidden and card fields are never named or timed.
- Only the path of an address is sent, like
/shop. Anything after a?or a#is dropped. Emails, long numbers and tokens inside a path become*. - Two visits are matched with a hash of a random salt that changes every Monday (UTC), your site key, the visitor's IP address and their browser details. The IP address is used in memory for that and is never stored. Old salts are deleted, so after about a week the hashes cannot be rebuilt, and the same person next week gets a new code.
- Bots and crawlers are kept apart and never counted with people. You can see them on the Visitors page, or switch them off in Settings so they are not written down at all.
Moxel does not obey Do Not Track or Global Privacy Control on its own. If you want it to, add data-respect-dnt to the script tag, and visitors who have either one on are not counted. Visitors whose browser blocks trackers are not counted either, and neither is anyone who declined tracking on a site that asks. Your numbers will read slightly low because of that, and the dashboard says so.
Nothing is stored in the visitor's browser, so many sites run Moxel without a consent banner. Whether that is right for yours depends on where your visitors live, and that call belongs to you and your lawyer. What we collect, how long we keep it and which services handle it are all on the privacy page.