Cookieless tracking and GDPR

Muro measures how people use your site without tracking the people themselves. There are no cookies, no IP addresses in storage and no identifiers that follow a visitor across sites. Read this page when you're writing a privacy policy or deciding whether you need a consent banner.

What the script sends

Every event that muro.js sends contains only these fields:

• Project ID. Which of your sites the event belongs to.
• Event ID. A random ID made in the browser, used to ignore accidental duplicate deliveries.
• Event type. One of:
  • pageview, sent on page load and on single-page-app navigation;
  • custom, sent by window.muro.track() or a data-muro-event click;
  • session_end, sent once per session when the tab is hidden or closed, so session length is accurate.
• Custom event name, for custom events only.
• Path and query string, for example /pricing?ref=ph. The domain is not included.
• Referrer hostname, for example reddit.com. The full referring URL is cut down to the hostname in the browser before it's sent.
• UTM parameters: utm_source, utm_medium and utm_campaign, when they're in the URL.
• Device type, browser and operating system. Device type comes from screen width (under 768 px is mobile, under 1024 px is tablet, anything wider is desktop).
• Screen width.
• Timestamp.
• Properties, only on custom events where you pass them. You decide what goes in here (see Track custom events).

When the event arrives, Muro adds country, region and city, worked out from the request at the network edge, plus a visitor ID and a session ID, explained below. The IP address itself is never stored.

That's the whole dataset. Muro stores no names, emails, IP addresses or cross-site identifiers.

How visitor identity works

To count unique visitors without cookies or browser storage, Muro's server computes a SHA-256 hash when each event arrives:

daily salt | project ID | IP address (IPv6 shortened to its /64 network) | user agent

The result is a 64-character string that serves as the visitor ID for that day.

• The salt rotates every day. It's a random value unique to your project, kept only on Muro's servers and replaced by the first visit after midnight in your project's timezone. The old salt is deleted at that moment, so the same person visiting tomorrow counts as a new visitor, and nobody, Muro included, can link the two days.
• The IP address is never stored. It's used in memory to compute the hash and to limit abusive request rates, then discarded. It isn't written to a database, a log or a queue.
• Visitor IDs are scoped to your project. The same person on two sites that use Muro gets unrelated IDs.
• There's no long-term identity. Muro can't tell that today's visitor is the same person as last week's. That's deliberate.

Sessions are assigned on the server too. A session covers every tab of one browser and ends after 30 minutes without activity, or at midnight in your project's timezone.

No cookies, no browser storage

Muro never sets or reads a cookie, and muro.js stores nothing in localStorage or sessionStorage. Earlier versions of the script kept three keys (muro_s, muro_i and muro_t). The current script removes them if it finds them.

Where your data is stored

• Analytics data, meaning events, sessions, goals, orders and insights, is stored in a single Cloudflare D1 database in the Asia-Pacific region. It isn't copied to other regions.
• The dashboard runs on Vercel in Singapore and reads that database when you use it.
• Incoming events are handled at the Cloudflare data center nearest the visitor. That's where the IP address is used, in memory, to compute the visitor ID before it's discarded.
• The identity service that assigns visitor and session IDs holds only today's salt and the sessions that are still active. Cloudflare runs it in a data center of its choosing, usually near where your project's first visit came from. Idle sessions are removed within about 45 minutes. The first visit after midnight in your project's timezone replaces the salt and clears every session.

If your visitors are in the EU or UK, their data is processed and stored outside it. These transfers are covered by Cloudflare's and Vercel's data processing addendums, which include the EU Standard Contractual Clauses.

Do I need a consent banner?

This isn't legal advice. Whether you need a banner depends on where you and your visitors are and on the other tools your site runs, so check with a lawyer if you're unsure. These are the facts they'll ask about:

• Muro sets no cookies, and muro.js stores nothing on the visitor's device.
• Muro doesn't fingerprint visitors, build cross-site profiles or share data with advertising networks.
• The visitor ID is a hash of the IP address and user agent, computed on Muro's servers with a salt that changes every day. It can't be linked across days or across sites, and the IP address is never stored.
• The data is used only to show you your own analytics.

If you also run tools that need consent, such as Google Analytics or an ad pixel, they need it whatever you decide for Muro.

GDPR, CCPA, PECR and LGPD

Muro is built to collect as little as possible. Here's how that maps to the common privacy laws:

• GDPR (EU) and UK GDPR. Muro stores no names, emails, IP addresses or cross-site identifiers. The daily visitor ID is still derived from the IP address, and regulators can treat a hashed identifier like that as personal data, so mention Muro in your privacy policy.
• PECR and the ePrivacy rules (UK and EU). These rules cover storing or reading information on a visitor's device. muro.js sets no cookies and stores nothing in the browser. The Shopify pixel stores one key only when the visitor has allowed analytics (see Shopify pixel and consent).
• CCPA / CPRA (California). Muro doesn't sell or share the data it collects, and doesn't use it for advertising.
• LGPD (Brazil). As under GDPR, Muro stores no names, emails or IP addresses, and the daily visitor ID can't be linked across days.

Location is resolved from the request at the edge and kept only at country, region and city level.

Keep personal data out of your URLs

Muro records the path with its query string, so anything you put in a URL ends up in your reports. If your app puts emails, names, tokens or order numbers in URLs, such as /welcome?email=jane@example.com, that value is stored like any other path.

To stay safe:

• Don't put personal data in query strings. Use a POST body or server-side state instead.
• Never pass personal data as custom event properties. The Track an event dialog says the same: "Never personal data like emails".

In the Sessions journey view, query strings are hidden until you turn them on, and values that look sensitive are redacted. Your Pages reports still show the stored path, so the fix belongs in your URLs.

Shopify pixel and consent

If you use the Muro pixel for Shopify, Shopify asks how the pixel should treat visitor consent. Muro doesn't choose for you:

• Not required lets the pixel run before the visitor answers your banner, the way the Muro script does. Carts, checkouts and purchases are recorded without waiting for consent.
• Analytics makes the pixel wait for each visitor's consent. Visitors who never accept your banner aren't tracked at checkout, so fewer orders can be tied to a source.

The pixel remembers where a shopper first came from for up to 30 days in a muro_f key in localStorage, and only while Shopify reports that analytics is allowed. Without consent it stores nothing, and it never uses sessionStorage. Like the Muro script, it sends no visitor or session ID. The pixel never reads customer fields such as email, phone number, name or address.

Muro Links

When someone clicks one of your short links, Muro records the click time, referrer, country, region, city, device, browser and operating system. Visitors are counted with a privacy hash computed at the edge, and the IP address is not stored.

What Muro doesn't do

• No fingerprint is stored, and the only identifier is the daily-rotating hash.
• Muro doesn't sell or share your data with anyone.
• Muro runs no ad networks, retargeting or ad attribution on your data.
• Muro doesn't follow visitors from one website to another.
• Muro doesn't identify individual users.

Your data is only there to help you understand your own site.

Next steps