Technical privacy and storage

This guide describes the current browser tracker. Review the privacy policy for Seean’s service policy and configure your site’s consent flow for your requirements. A technical installation is not a legal compliance assessment.

Browser storage

The default tracker sets no cookies and keeps no visitor or session measurement identifier in localStorage or sessionStorage. Its temporary navigation state lives in memory. The browser opt-out preference seean_ignore can remain in localStorage.

The collector derives a pseudonymous visitor hash from a server secret, the website, UTC date, website domain scope, IP address and user agent. Raw IP addresses and user agents are not stored in analytics event records. The hash changes at midnight UTC and differs between websites. Network changes or shared networks can split or merge apparent visitors; these counts are not exact people counts. When no IP is available, the document’s temporary nonce replaces it, so reload continuity is not guaranteed.

Sessions are assigned by the collector. Activity for the same daily visitor continues a session until 30 minutes of inactivity, a backwards timestamp or a changed tagged campaign. The tracker removes legacy _seean_v and _seean_session storage when it initializes normally. Previously collected identifiers, saved reports and orders stay intact; this transition does not re-identify historical visitors.

Origins and domains

The configured website domain and its subdomains share daily identity when they use the same token and request metadata. Unrelated domains remain separately scoped. Optional cross-domain handoff uses a same-day random token in links and sessionStorage; the server hashes it separately for each website and UTC day. It is off unless enabled on both sites through the Explicit snippet or Minimal dashboard configuration. No incoming handoff is adopted before that configuration succeeds. The raw handoff token is not stored in analytics records.

Data sent by the tracker

Collection payloads contain the public site token, a temporary session nonce, browser timezone when available, hostname, pathname and UTM source, medium, campaign, term and content values. Opt-in cross-domain collection also sends its handoff token. The collector returns the daily visitor hash for optional checkout attribution. Pageviews include the document session’s entry referrer. Web Vitals send metric measurements and IDs; custom events can include the properties supplied by your application.

The page field uses location.pathname, not the full URL. However, UTM values are read separately, and the entry referrer can contain URL information allowed by the browser’s referrer policy. Do not put passwords, private tokens or personal details in paths, campaigns or custom-event properties. Omitting a full page URL does not automatically sanitize those fields.

The collection server also receives normal request metadata. This browser-field list is not a claim that network requests hide the sender’s IP from hosting infrastructure.

Browser presence

While a tracked page is visible, a presence signal every 30 seconds sends the same site-scoped daily identity inputs, pathname and entry referrer used by the tracker. It does not inspect page content, record clicks or identify an account. Presence respects the same privacy signals, exclusions and collection availability. It adds no pageviews, custom events or usage, and does not extend analytics sessions.

The collector keeps only the latest presence state per website and daily visitor, with approximate location/device metadata for Realtime. It is separate from raw event history. A state expires from the online window after two minutes; bounded cleanup runs every five minutes. Reset and website deletion also clear it. Existing encrypted recovery copies follow the backup retention policy.

Privacy signals and opt-out

The tracker suppresses collection for Global Privacy Control (true), supported Do Not Track values (1 or yes), browser automation (navigator.webdriver === true) or localStorage seean_ignore set to true. It checks these before initializing visitor state and before sending later activity. Existing storage is not automatically deleted when a preference changes.

An initially ignored page exposes no-op tracker methods; window.seean existing does not prove collection. If an initial opt-out is removed, reload the page to initialize tracking. A tracker that was already active checks subsequent opt-out changes before sending more data. See Exclusions for the browser control and server-side pathname/hostname rules.

Seean does not provide a consent banner or a general consent-management API. If your site requires permission before analytics, your consent system must control when the script loads and what happens when permission changes. data-local only enables localhost testing; it does not override privacy preferences. A tag-manager trigger is not itself visitor permission.

Verify the consent states your site supports, including refusal and later acceptance, alongside the installation checks. Do not interpret a successful script download or an empty 204 response as proof that an event was stored.

Removal

Remove the script from every installation location and publish the change to stop future collection on newly loaded pages. An already open page can retain the loaded script until it is reloaded or closed. Removing the script does not erase browser storage or previously collected reports. Review website management for available data-management actions.

Server storage and retries

Raw events and Web Vitals use the analytics store. Accepted records stay queued during a temporary storage-transfer failure and are retried automatically. Storage retries keep an accepted record’s identity: copying the same record between Seean’s stores does not add another visit or Web Vitals sample. A later accepted value for the same Web Vitals metric ID updates that sample, including when an older tracker omits its update sequence. Separate incoming pageview requests are still separate events; this is not a guarantee that your integration can resend arbitrary collection requests without counting them again.

With queued raw storage, an unfamiliar or expired Web Vitals identity must be checked before a sample is accepted. That check does not wait for unrelated queued events or a recovery snapshot. Each known measurement keeps its latest accepted value available until that specific update has reached the analytics store; an expired, fully transferred identity can be cleaned independently of other websites’ traffic. If the analytics store itself is unavailable, a cold identity check returns 503 without adding the sample or charging its allowance. Pageviews and updates whose identity is already known can still be accepted into the queue. After a website reset, identity lookup only considers measurements at or after that reset boundary. The browser tracker does not guarantee replay of rejected requests; missing measurements are not zero scores.

A small per-website activity summary stores the first and latest prepared event times and the latest pageview time for waiting states and setup health. It contains no event properties or visitor identifiers and follows website reset and deletion.

Collection also continues during recovery snapshots. Newly accepted records can briefly wait in the transfer queue, so a report may remain in its preparing state until those records are available; readers that need them request the transfer immediately, and only a running recovery snapshot defers it.

Pageviews, events, Web Vitals and orders follow the rolling three-calendar-year retention policy. Cleanup uses a UTC calendar cutoff with millisecond precision. Resetting or deleting a website also applies to records awaiting storage transfer; a delayed internal retry cannot restore them to reports. Encrypted recovery copies follow the separate backup retention policy.

Raw cleanup runs in bounded background batches. Deletion markers retain only the keys needed to prevent an older internal retry from recreating a removed record; event properties, paths and measurement values are removed from the active version. Replaced storage parts and encrypted recovery copies are reclaimed on their separate storage schedules. This is not an immediate secure erase of every physical copy.

If source retention removes records needed by an older Overview’s on-demand breakdown, refresh the analysis before opening that list. Saved report results remain unchanged; the system does not mix retained totals with recalculated details from a different dataset.

Something unclear? Contact support.