Privacy

The script is a small file that loads asynchronously. It records the page path and title, the referring site, the campaign parameters, coarse device and browser labels and the coarse country, then sends them to the ingestion endpoint. It does not render anything and it does not change the layout of the page.

It fails quietly. If the network is down or the endpoint refuses the events, the page keeps working and the queue stays bounded, so a broken network can never grow the memory of the visitor browser without limit.

It initialises once. Loading the script twice on the same page does not double count the pageviews.

The script creates one random identifier and stores it in the browser under the key aback_vid. It is generated by the browser, it is not derived from anything about the person, and it stays in the browser of the site you installed it on.

The server converts it into a one way value with a secret key, using a salt that belongs to your website, and stores only the result. The raw value is never stored and it cannot be reversed. The same browser therefore produces a different identifier on each of your websites, and the identity is not shared with any other product.

There is no fingerprinting. No canvas hash, font list or audio stack is collected, and the device, browser and operating system labels are families, not versions.

• The page path and the page title of a pageview.
• The referring site, when the browser provides one.
• The campaign parameters utm_source, utm_medium, utm_campaign, utm_term and utm_content.
• A coarse device category, browser family, operating system family and screen size class.
• A coarse country as a two letter code.
• The name and the properties of the events you send.

• No IP address. No analytics event contains one. The address of a client is used transiently at the edge for the rate limit and for the country code, and it is not written to the analytics tables.
• No form contents, no keystrokes and no page snapshots.
• No device fingerprint and no advertising identifier.
• No cross-site identifier, so a visitor is not recognised on another property.
• No selling of visitor data and no use of it for advertising or for training models.

Query strings are removed from the recorded path. Only the campaign parameters above are read, so a token that ends up in a link is not stored.

The tracking script sets no cookie. It uses two keys in the local storage of the site it is installed on: aback_vid for the identifier and aback_optout for the opt out. Removing the local storage of the site removes both.

The dashboard itself uses one session cookie named abk_session to keep you signed in. It is marked httpOnly and SameSite, and it holds an opaque token whose digest is what the server stores.

You can offer an opt out on your own site. The flag is stored in the browser of the visitor and it stops the events from that browser.

The Do Not Track signal is not honoured by default. Turn it on for the website in its settings, or add the attribute to the snippet:

Every website can carry a list of hostnames that are allowed to send events for it. You prove that you control a hostname by publishing a DNS TXT record at _aback-analytics.example.com. The value in the record identifies the website. It is not a secret: it only proves that whoever controls the domain also controls the website.

Once a hostname is verified, an ingestion request from another origin is refused, so a copy of your tracking id on a site you do not control cannot write into your reports.

A request from www.example.com is accepted for a website that allows example.com, and so is a request from a subdomain of it. The origin check is one signal among several and not a form of authentication, because a non browser client can send any header it likes.

The origin policy decides which origins may send events for a website. It has two settings in the data collection section of the site settings.

• Only my domains is the default. Events are accepted from the domain of the website and from the hostnames you verified, and from nowhere else. A domain that has not been verified yet does not restrict anything, so the rule only gets stricter as you verify more.
• Any origin accepts events from every origin. Use it only when the script also runs somewhere you cannot list, for example a hosted preview, and turn it back off afterwards.

The response to an accepted request carries the origin of the request, so the browser on your site can read it. A refused origin gets no such header, so it learns nothing about the website, and the request is refused before anything is stored.

The origin policy is not a security boundary on its own. A client that is not a browser can send any header it likes, so the real protections are the rate limit, the monthly quota and the fact that the endpoint never returns anything about the account.

You can exclude the paths your own team uses, for example /admin or /staging.

You can also exclude traffic by address. The address is never stored in the clear. It is hashed with your website's own salt and a server side secret, and only that hash is kept, so the list cannot be turned back into a list of addresses. Local development addresses can be excluded on their own.

There is no way to exclude one person, because the tracker does not know who a visitor is. It only knows a pseudonymous identifier.

Automated traffic is filtered on the server. Requests whose user agent looks like a crawler, a preview service or a script are not recorded.

A path rule excludes a pageview when the path matches the rule exactly, when it starts with the rule followed by a slash, or when it matches a wildcard rule that starts and ends with an asterisk.

The rules are stored per website and are applied on the server, so a page that is excluded never reaches the database, whatever the browser sends.

Raw events are kept for the retention window of the plan: 30 days on the free plan, 365 days on Pro and 730 days on Business. The aggregates are removed with the events they came from, so a deleted day does not come back in a report.

Deleting a website removes its events, sessions, aggregates, goals, funnels, API keys and revenue records. Deleting the account removes the account and its websites.

The full policy, including the subprocessors and how to ask for an export, is on the privacy policy page.