Analytics privacy, consent and data

Counting without cookies#

By default a visitor is a one-way hash of the site, the IP address and the browser, with a salt that changes every day and is then forgotten. So a person counts once a day, can’t be followed from one day to the next or across sites, and their IP address is never stored. Settings → Privacy can also shorten the IP address before hashing.

Remember returning visitors (a random ID in a first-party cookie) is available if you want returning-visitor numbers; it’s off by default.

What’s stored, and what never is#

Countries come from the browser’s time zone — or your CDN’s country header if you choose — never from an IP lookup. You can also record no countries at all.

Consent#

• Respect Do Not Track (and Global Privacy Control) — on by default.
• Wait for consent — off by default, since counting is cookieless. When on, nothing is counted until consent is given through naiAnalytics.consent(true), a nai:consent event, a nai_consent cookie, or the WP Consent API’s “statistics” category.

How long data is kept#

• Keep detailed events: 90 days by default (7–3650). Real time and a few details use these.
• Keep daily totals: forever by default, or a number of days. Every report reads these, so they stay available after detailed events are cleaned up.
• Clean-up runs daily; Clean up now runs it at once, and Health shows the storage used.

Alerts#

Choose alerts and their thresholds: tracking stopped, traffic drop, conversion drop, missing pages spike and referral spike. Alerts appear as Native AI notifications — by email too if you choose — at most once a day each.

Reset#

Settings → Danger zone → Reset analytics data deletes all analytics data. It’s for administrators only and needs the phrase RESET ANALYTICS typed in. It’s separate from switching Analytics off, which never deletes anything.

For where your data lives across Native AI, see Privacy & data.