SublimDocs

Privacy & data

Sublim Analytics is built to measure audiences without tracking individuals. Data is hosted in the EU.

No cookies

The tracker sets no cookies and keeps no visitor identifier in the browser. A visit is recognised on our side from a hash of the IP address, the user agent and the site's domain, with a salt that changes every 30 days. The same person can't be followed across sites, or over long periods.

What is never collected

  • IP addresses are never stored. They are used once, to compute the hash above, look up the visitor's country and apply your IP exclusions, then discarded.
  • Form values (what visitors type) are never sent. Form tracking only sends field names and types, and leaves out sensitive fields entirely. See Forms & leads.
  • Personal-data keys found in the dataLayer are removed before sending.
  • In session replays, all inputs are masked.

Properties are yours to define: don't put personal data in the ones you send with trackEvent.

Traffic that is ignored

  • localhost and local IPs, unless trackLocalhost is on;
  • bots, crawlers and headless browsers;
  • the IPs, paths, hostnames and countries excluded in your project settings.

What is stored in the browser

Only technical data, in localStorage and sessionStorage, never an identifier:

KeyStoragePurpose
sublim_project_settings_<projectId>localStorageCached project settings (cart / thank-you URLs, dataLayer).
sublim_retry_qlocalStorageEvents that failed to send, retried for up to 5 minutes.
sublim_last_cart_<projectId>localStorageLast cart total, used for purchase detection (2 hours).
sublim_purchase_…, sublim_dl_purchase_…localStorageOrders already counted, so they aren't counted twice.
sublim_ty_<projectId>_<path>sessionStorageThank-you page already processed in this tab.

Because the measurement is cookieless and doesn't identify visitors, it is generally used without a consent banner. Check what applies to your own use with your DPO.

  • Events forwarded from the Google dataLayer can wait for Google Consent Mode's analytics_storage grant. This is on by default.
  • To wait for consent for all tracking, load the snippet, or call init() with npm, only once your consent platform reports it. The tracker has no separate opt-out switch.
PreviousEvents HTTP APINext Troubleshooting