Tracking modes

Each site has a tracking mode. You choose it in the site's Settings tab, under Tracking mode. The dashboard always shows which mode a site is in.

Private (the default)

• No cookies and nothing stored in the browser.
• Each visitor gets a hash made from a salt that changes every day, the site, the IP address and the browser's user agent. The IP address is never stored.
• The same person on the next day counts as a new visitor.
• Ad click ids (gclid, gbraid, wbraid, fbclid) are read on the landing page and kept with that visit's events only.
• The attribution report can only tie a sale to a source within the same visit.

Private mode is built so that in most places you do not need a consent banner for it. We are not your lawyer, so check the rules where you and your visitors are.

Attribution

Attribution mode is on paid plans: Solo, Studio, Agency and Custom. Free does not include it. The script keeps a random first-party id and the latest click ids on your own domain for 90 days. So a sale on day 3 ties back to the ad or short link clicked on day 1.

What it stores, on your domain only:

Each is a first-party cookie and a copy in localStorage. A new Google click replaces older Google click ids; a Meta fbclid stays until a newer one comes. If Meta's own pixel set _fbp or _fbc cookies, the script reads them too, so conversions sent to Meta match better.

• The id lives on your domain, not on ours. It is not shared across sites, and Sporetag cannot follow a person from one site to another.
• Customer profiles build on this id. Call sporetag('identify', { email }) on signup or checkout, and the person's visits join one profile.
• Your own server receives the _st_id cookie. Send it as visitor.id with the Events API to tie a server sale to earlier visits.
• Safari and some other browsers may clear script-set storage after 7 days without a visit. Then the next visit starts a new id.
• It stores data on the visitor's device. In many places that needs consent first. In the EU and UK this usually means a consent banner.

You are responsible for consent on your site. Sporetag gives you a switch to wait for it.

The tag

Attribution mode uses its own tag. Copy it from the site's Settings tab after you switch:

<script defer data-site="shop.example.com" data-mode="attribution" src="https://sporetag.com/sa.js?d=shop.example.com"></script>

If you switch back to Private, the Attribution tag keeps working but stores nothing. You can swap it back to the plain tag when you like. If the plan ends, the site works as Private.

Wait for consent

Turn on Wait for consent in the site's settings. The script then stores nothing, and sends nothing to Meta from the browser, until your consent tool tells it to. Until then it works like Private mode.

// Call this when the visitor agrees, for example from your consent banner.
sporetag('consent', true);

// Call this when they say no, or take consent back. It deletes what was stored.
sporetag('consent', false);

Before consent, sporetag('identify', ...) does nothing too.

Many consent tools let you run a line of code when a category is accepted. Put this line there. The script remembers the yes for 90 days, so you only need to call it when the visitor answers.

Honest notes on consent

• Private mode does not store anything on the device and keeps no id across days. That is why it usually needs no banner. It still processes the IP address in memory to make the daily hash.
• Attribution mode stores an id and click ids on the device. Rules like the EU ePrivacy Directive usually ask for consent before that, unless it is strictly needed for a service the visitor asked for. Measuring ads is usually not.
• Sending conversions to Meta shares the visitor's IP address, browser and click ids with Meta, plus hashed email and phone when you send them. That usually needs consent in the EU and UK in either mode, and a line in your privacy policy everywhere.
• Customer profiles keep hashed emails and phones, and the email itself encrypted unless you turn Show customer emails off. Name this in your privacy policy. You can delete a customer or forget an email at any time.
• Server events you send with the Events API are yours to justify. Send only what your privacy policy covers.

When unsure, use Private mode, or Attribution mode with Wait for consent on.

Which one to pick

You can switch a site between modes at any time. Switching does not change data you already have.