Last updated: October 17, 2026
Pieowl counts visits without cookies and without saving IP addresses. This page lists every piece of data the Pieowl script sends, what we never store, and what becomes personal data only if you turn it on. You're welcome to link to this page from your privacy policy, or copy the text at the bottom.
The short version
- No cookies. Nothing stays on your visitor's device.
- IP addresses are never stored.
- A visitor ID that changes every day, so visitors can't be followed from day to day unless you identify them.
- Data stored in the EU.
- No names, emails or user IDs unless you send them with
identify().
What the script collects on every page view
| Data | Example | Why |
|---|---|---|
Page address, including the query and # part | /pricing?plan=growth | Top pages, funnels |
| Page title | "Pricing — Acme" | Readable reports |
| Referrer | news.ycombinator.com | Traffic sources |
UTM and ref tags in the address | utm_source=newsletter | Campaigns |
| Browser, operating system, device type, brand and model (from the user agent) | Chrome 140, macOS, desktop | Device reports |
| Country, region, city and the city's approximate coordinates (looked up from the IP address) | FR, Île-de-France, Paris | Geo reports and the map |
| A daily visitor ID | a random-looking hash | Counting unique visitors and sessions |
| Time of the visit and time on page | 14:02, 35 s | Sessions and engagement |
| Clicks on links to other sites, if you turn on outgoing link tracking | github.com/... | Outbound clicks |
| Events you send yourself, with the properties you add | signup, { plan: "starter" } | Your own goals |
| A "looks like a bot" flag, for example traffic from a data center | datacenter_ip | Keeping bots out of your numbers |
Tip: don't put emails, names or other personal data in page addresses, like ?email=…. Pieowl stores the full address, query part included.
How the daily visitor ID works
When a visit arrives, Pieowl combines the IP address, the browser's user agent, your project and a secret salt, and turns them into a one-way hash. The salt changes every day at midnight and old salts are thrown away, so the same visitor gets a new ID the next day. The IP address itself is used for this hash and for the location lookup, then dropped. It is never written to storage.
What we do not collect
- Cookies. The script never sets one.
- Local storage, session storage or IndexedDB. The script stores nothing on the visitor's device.
- IP addresses. Our event storage has no column for them.
- Fingerprints across sites. The visitor ID includes your project, so the same person gets a different ID on every Pieowl site.
Personal data you can turn on
By default, Pieowl has no names, emails or user IDs for your visitors. These features add more personal data, so mention them in your privacy policy if you use them:
- Identify users. If you call
identify()with a user ID, name or email, Pieowl links that visitor's events to that person. - Session replay. It's off until you turn it on for a site. It records what happens on the page, and it needs your visitors' consent: by default it records only after your site calls
allowReplay. All text and form inputs are always masked, and you can remove whole elements withdata-pieowl-replay-block. - Custom event properties. Whatever you send with your own events is stored as you send it.
Where the data is stored and who can see it
- Your analytics data is stored in the EU.
- Only people you invite to your Pieowl organization can see it. You can give each person read, write or admin access per project.
- If you share a dashboard by link, anyone with the link can see that dashboard. You can add a password.
- If you connect your own AI assistant over MCP, your questions and answers pass through that assistant's provider, under your own account with them.
- Our subprocessors are listed in the DPA.
How long data is kept
- While you're on a plan, your data is kept for up to 3 years on Starter and up to 5 years on Growth. Older data is deleted automatically once a month.
- If your trial or plan ends without payment, your analytics data is deleted 7 days later. We email you before that happens.
Copy this into your privacy policy
Analytics. We use Pieowl to understand how visitors use our website. Pieowl does not use cookies and does not store anything on your device. It does not store your IP address. It uses your IP address only briefly to look up your approximate location (country, region and city) and to create a visitor ID that changes every day. Pieowl collects the pages you visit, the website that referred you, your browser, operating system and device type, and the time of your visit. The data is stored in the European Union. We process this data on the basis of our legitimate interest in understanding and improving our website. You can read more at https://pieowl.com/data-policy.
If you use identify():
When you sign in, we link your analytics events to your account so we can understand how customers use our product.
If you use session replay:
We record some sessions to see how visitors use our pages. Text and form inputs are hidden in these recordings.
Questions
Does Pieowl use cookies? No. The script never sets a cookie.
Does Pieowl store IP addresses? No. The IP is used for the location lookup and the daily visitor ID, then dropped.
Can Pieowl recognise a visitor tomorrow? Not one you haven't identified. The visitor ID changes every day. Visitors you identify with identify() are linked across days.
Is the data shared with advertisers? No. Pieowl doesn't sell your data or use it for ads.
Where is the data stored? In the EU.
Is Pieowl GDPR compliant? Pieowl is built for GDPR: no cookies, no stored IPs, data stored in the EU. Compliance also depends on what you track and what your privacy policy says. Ask your legal advisor about your setup.
Can I sign a DPA? Yes, see the DPA.
Related: do you need a cookie banner?, privacy-friendly analytics, analytics without a cookie banner, EU analytics, Pieowl's own privacy policy, pricing.