What is stored
The fields stored for each event, query strings, the visitor's browser storage, replays and bots.
What is stored for each event
Each pageview or event is stored as one row with these fields:
| Kind | Fields |
|---|---|
| Page | Time, host name, path, query string (as your settings allow), page title, the referrer as the browser sent it and its domain (both empty when the referrer is your own site), campaign (utm_*) parameters, channel, affiliate. |
| Visitor and session | The visitor id (a hash), a random session id, and the user id if you called identify. |
| Location | Country, continent, region, city, time zone and coordinates rounded to two decimal places (about 1 km), looked up from the IP address; the network (ASN and its name) and whether it belongs to a data centre. |
| Device | Browser and its major version, operating system and its version, device type, screen size, language. |
| Event | Its type and name, and the properties you send. For autocaptured events, their own few properties (a link's address and text, a button's tag name, text and id, a form's id, name, action path, method and number of fields, a field's name and type, a copy's element and length). For errors: name, message, stack trace, file, line and column. For web vitals: the five measurements. |
Never recorded in events: form field values, what visitors type, the text they copy, cookies, and IP addresses.
Link text is cut to 200 characters and button text to 100. The fragment of a page address (#...) is never sent,
except as a route under hash routing. What session replay records,
when you turn it on, is described below.
Besides events, PilotFox keeps:
| Data | What it holds |
|---|---|
| User profiles | For each user id you identified: its traits (up to 4 KB), when it was first seen, and the email trait your server sent, which links payments. |
| Identity links | Which visitor ids were linked to which user id, by identify or by a member linking a visitor by hand. |
| Payments | The payments imported from your payment provider (or recorded through the payments API) and how they link to visits. The buyer's email is stored only with Store customer emails on (Site settings → Revenue, off by default), and shown only to people who can see sessions. |
| Session recordings | See Session replay below. |
| Bot requests | See Bots below. |
Query strings
Site settings → Privacy & identity → URLs and query strings controls what is kept of page addresses' query strings. It is applied on the server, before anything is stored:
| Setting | Default | Effect |
|---|---|---|
| Store query string parameters | All parameters | All parameters, UTM parameters only (the utm_* parameters and the known ad click ids such as gclid and fbclid), or None. |
| Strip parameters | None | Up to 50 parameter names removed before anything is stored, whatever the setting above, for example token, email or session_id. Names are compared without regard to case. |
- Campaign parameters (
utm_*) and the affiliate parameter are read from the address before these rules apply, so channels, campaigns and affiliates keep working with query strings turned off. - The tracker option Query strings (Site settings → Tracking code) decides whether the browser sends the query string at all. With it off, nothing of it reaches PilotFox, campaign and affiliate parameters included; to store no query strings but keep those, leave it on and choose None here.
- On the return page of a payment provider, the script removes
emailandlicense_keyfrom the address before sending it, whatever the settings.
Storage in the visitor's browser
The script sets no cookies. It uses the browser's storage only for these keys, each written only in the situation given:
| Storage | Key | Written when |
|---|---|---|
localStorage | pilotfox:uid | After identify(): your user id. Removed by reset(). |
localStorage | pilotfox:optout | After optOut(): 1. Removed by optIn(). |
localStorage | pilotfox:ignore | After a page was opened with ?pilotfox_ignore=true: 1. Removed by ?pilotfox_ignore=false or optIn(). |
sessionStorage | pilotfox:rs | Only on sites with session replay on: whether this tab is recorded (1 or 0). |
- When storage is blocked, these values live in memory for the page.
- With a custom
data-namespace, the keys start with that name instead ofpilotfox. - The visitor id is never stored in the browser: the server computes it for each request.
Session replay
Session replay is off until you turn it on for a site. Then, on the tabs it records:
- every input is masked by default, and password fields stay masked even if you turn that off;
- hidden and file inputs, CSRF tokens and canvas content are never recorded, and editable text is always masked;
- your settings and markup can mask or leave out more (
rr-mask,rr-block,rr-ignore, CSS selectors); - pages skipped by
data-skip, excluded paths and host names outside Allowed hostnames are not recorded; - an opt-out stops it at once, in every open tab of the site, and discards what was not yet sent.
Recordings are stored in the instance's object storage and kept for REPLAY_RETENTION_DAYS days (30 by default on a
self-hosted instance).
Bots
Requests the bot filter recognises are kept apart from your analytics (unless you turn blocking off) and shown in the Bots report. For each one PilotFox stores the time, the visitor id, the event type, host name, path, referrer domain, country, network, browser, operating system and device type, the user agent (up to 512 characters), the bot's name, operator and category, and which checks flagged it, with their score. It never stores the IP address.
A self-hosted instance keeps bot requests for BOT_EVENTS_RETENTION_DAYS days (90 by default) and events until they
are deleted, unless EVENTS_RETENTION_MONTHS sets a limit (see Configuration).