Privacy
Trace learns from patterns. It can't follow a person.
Most tools collect everything and ask you to configure privacy afterwards. Trace was built the other way round: what it never collects can't leak, be subpoenaed or end up in a prompt.
What Trace records
- The page path, with ids grouped (
/products/:id) - Which element was clicked, by its selector and the label of a button or link, with every digit masked
- How far people scroll and how long they stay
- Whether a form was started and submitted
- Error messages and failed request URLs
- Screen size and browser
- The site a visit came from, never the full link
- Events you send yourself, with the properties you allow
What it never records
- Anything typed into a field
- Session recordings or screenshots
- Page content and page titles
- Query strings and URL fragments
- IP addresses: read once for the daily hash, never stored
- Cookies, local storage or device fingerprints
- Names or emails. Signed-in users appear only as a hash you make.
How cookieless tracking works
NO COOKIES
Visits are counted, not followed
The server tells visits apart with a hash of address and browser, salted with a value that changes every day and is then deleted. By default nothing is stored on the device, so there is no cookie to ask consent for. Plausible counts visits the same way.
SCRUBBED TWICE
Secrets removed in the browser and on the server
Emails, card numbers, IBANs, phone numbers and tokens are replaced before an event leaves the page, and again before it's stored. Patterns can't catch a name in a button label, so mask those elements.
YOUR RULES
Mask, ignore and drop
Add data-trace-mask to any element, ignore whole pages like /admin*, or drop event properties you never want stored.
TOTALS ONLY
Your AI never sees a visitor
Your coding agent reads counts and rates per page. There is no per-person data to hand it, even by accident.
TESTED
Fake secrets in every build
Tests feed the scrubbers fake card numbers, tokens, emails and passwords. The build fails if any of them gets through.
OPEN SOURCE
Read every line
The collector is MIT, the server AGPL. Check what runs on your pages instead of trusting a policy.
Server errors, without the request
The clients for Rust, Node.js and Ruby send an error's class, its scrubbed message, the backtrace, the route template, the status and the release. Never bodies, parameters, headers, cookies or who was signed in, and there's no option to send them. Trace keeps counts and one sample backtrace per error, not individual requests. How server errors work
Signed-in users, without identifying them
If your app has accounts, call trace.identify() with a hash of the user id. Someone who signs in on Monday and Friday then counts once, which makes retention honest. Trace never learns the real id, a name or an email. The hash is still pseudonymous data, and you stay its controller.
Where the data lives
Hosted: in Finland, in the EU, never sold or shared. If the hosted service ever stopped, you would export your data and self-host with the same tag and trace.json. Community: on your own server, and it never leaves.
Questions legal will ask
Do we need a cookie banner for Trace?
In its default mode Trace stores and reads nothing on the device, which is what cookie consent rules like the ePrivacy Directive are about. GDPR still applies to the daily hash, and most sites rely on legitimate interest for it. Your own lawyer has the final word for your site.
Is it GDPR compliant?
Trace processes as little as it can: no names, emails, stored IP addresses or persistent ids. For hosted accounts, Trace is your processor under Article 28, and the data processing terms apply automatically. Need a signed DPA? Write to me. Data is kept for your plan's retention, then deleted.
Can we use it on a site for children?
It is designed for it: no recordings and no typed text. Think twice about trace.identify() there: following someone across days is per-person tracking, even with a hash. Check with your DPO for your own case.
What if our site already asks for consent?
Set the tag to wait for your consent tool. After a yes, Trace may keep an id on the device to follow visits across days.
Compare: Google Analytics alternative · Plausible vs Trace · What is cookieless analytics?