Privacy and consent

The tracker sets no cookies, stores no identifier for the visitor on their device, never keeps a raw IP address, and counts visitors with a keyed hash that expires at UTC midnight and differs on every site. What it does keep in the browser is four short-lived technical values — a per-tab session hint, an offline queue, the consent state and a five-minute config cache — and data-storage="none" removes even those. These are design properties of the software, not policies: they hold because of how the tracker and the collector are built, so they hold on your deployment without you configuring anything. Every exception is named further down this page.

• Global Privacy Control: a visitor sending GPC is not measured. Honoured in the browser and again at our servers, so no snippet configuration can override it.
• Do Not Track: honoured by default; a per-site setting on the snippet.
• One consequence worth knowing: privacy-signal visitors are simply absent from your numbers, which is one reason totals can sit below cookie-based tools.

Most sites need no banner for measurement with this tracker: it is first-party, aggregate, never combined across sites and never shared onward. Two features go beyond that — identify and attributed revenue, which link a visitor to a person or an order. Your code calls those, so the consent question for them is yours; the script gives you the hook rather than deciding for you.

If your legal position wants explicit consent for all of it:

<script
  async
  src="https://c.analytics.carthagos.com/oa.js"
  data-key="YOUR_TRACKING_KEY"
  data-collector="https://c.analytics.carthagos.com"
  data-require-consent="true"
></script>

// when the visitor decides:
oa.consent("granted"); // or
oa.consent("denied");

• With data-require-consent, nothing is collected until granted.
• Denied is final for that visitor regardless of any other setting, and the choice persists in localStorage on their device — or for the page only, in strict mode.
• Every signal the script could send passes through one decision point; there is no path around it.
• With attributed revenue off, no payment is linked to a visitor at all: no order_id is sent, one that arrives anyway is dropped on the server, and the matcher skips the site — including the routes that come from your own payment integration rather than a browser.

All analytics data is stored and processed in the European Union (Helsinki, Finland) and does not leave that infrastructure. Country and city come from a database file on our own servers; no IP address is ever sent to a geolocation service. The full subprocessor list is in the Privacy Policy.