What data does Attriboo track?
Attriboo connects recorded website activity to payments using a browser identifier and, when used, identity information. The standard tracker is not anonymous analytics. Review the data below before installing it on your website.
Instructions reviewed
Website activity
The collection endpoint uses an IP address to evaluate exclusion rules; it is not stored as an analytics event field by that endpoint. Hosting and infrastructure providers receive network information to deliver requests. This does not mean the entire service never processes IP addresses.
| Data | What it does |
|---|---|
| Browser identifier | A random _atb_vid value helps recognize the same browser across visits and your own subdomains. Different devices or cleared storage can appear as different visitors. |
| Page paths and activity times | Records pageviews and supported page changes, including hash-based app routes. The usual page path excludes the query string, but campaign fields and referrers are handled separately. |
| Traffic sources and campaigns | The script sends the referrer, UTM labels and the recognized ad click ID type. The collection endpoint classifies the source and stores the referrer domain. |
| Device and approximate location | Browser requests carry network and user-agent information. The collection endpoint derives device, browser and operating-system categories and uses hosting country/city headers where available. |
| Goals and optional answers | Configured goals, custom event names and metadata, supported form/booking events, and submitted post-purchase poll answers can add information to the visitor record. |
Form emails and payment matching
Automatic form-email capture is off by default. To enable it, open Settings → Privacy & data, enable Capture email fields from submitted forms, save, and replace your installed code with the version from Setup. The script must have data-auto-identify="true" before it loads to enable this feature.
The email-capture setting only controls automatic form-email capture. Explicit identify calls, payment-provider records and other integrations can still supply identity information. It does not remove cookies, stop pageviews, or erase earlier data.
Supported checkout integrations can carry the visitor ID in checkout links, cart attributes or payment metadata. Connected payment providers can supply buyer contact details, order references, amounts, currency, refunds and recurring-payment information. Which fields arrive depends on your integration.
Keep unnecessary personal information out
- Use campaign names such as spring-newsletter rather than an email address or customer name in UTM labels.
- Keep passwords, access tokens, card details, medical information and other sensitive information out of URLs, event names, metadata and poll answers.
- Check page paths and referrers as well as query strings. Removing query strings from a page path does not sanitize every field the browser or your integrations send.
- Enable identity and goal features only where they serve a defined, disclosed purpose. Review who can access the resulting visitor and revenue reports.
A random identifier is not a promise of anonymity
A browser ID can link activity over time and can be connected to an email or payment. Treat identifiable and pseudonymous records as personal data where the applicable law requires it. Removing a name alone does not make a visitor journey anonymous.
Still need a hand?
Send a question without needing to sign in.