The short version
- No cookies, and no browser storage of any kind. The tag does not set a cookie, does not touch localStorage or sessionStorage, and does not use IndexedDB.
- No cross-site identifiers. Nothing we record follows a person between sites.
- No IP address is ever written to our database. It is used in memory to derive a country and check for automated traffic, then discarded. See below for what infrastructure logs do hold.
- No profiles. We cannot build one, because we do not hold anything to build it from.
Why this is easy for us to promise. Our product answers "did this ad load, and could anyone see it". That question is about an advertisement, not about a person, so identifying anyone would add cost and risk while answering nothing we are asked.
What the tag sends
| Field | What it is |
|---|---|
| Impression ID | A single-use identifier for one ad placement, generated by the ad server. It is not linked to a person and is meaningless outside that one impression. |
| Campaign, creative, size | Which advertisement it was. |
| Site or app | Where the ad appeared. Not the page URL or its query string. |
| Measurement | How long the ad was on screen, what share of it was visible, how many samples were taken, whether the tab was in the foreground. |
| Browser family and device type | Coarse — "chrome", "desktop". Not a user-agent string, and not a fingerprint. |
| Country | Two letters, derived at the edge. Never finer than a country, and never stored alongside anything that identifies a person. |
What happens to the IP address
Every HTTP request necessarily carries an IP address, because that is how the internet works. Ours is used in memory to derive a country code and to check for obviously automated traffic, and is never written to our measurement database. No report, export or query we run can return one, because the column does not exist.
The honest caveat, because an absolute claim here would be false.Like every service on the internet, our infrastructure — the CDN, the load balancer, the web server — writes short-lived operational logs that can contain the requesting IP address. They exist to debug outages and absorb attacks, they are never joined to measurement data, and they are not used to identify anyone. What we can promise is the part we control: nothing in the product reads them, and no measurement we store is linked to one.
When a request is subject to GDPR and consent has not been given, the collector sets an ipless flag, and from that point the country is recorded asZZ and the network identifier as zero. That decision is made in code, not by policy, which is what makes it reliable.
How long anything is kept
| Data | Kept for | Why |
|---|---|---|
| Raw beacons | 30 days | Long enough to re-run a month's reconciliation. |
| Rejected requests | 7 days | Only for debugging a broken integration. |
| Ad server logs | 30 days | The other half of the reconciliation. |
| Reconciled results | 400 days | Aggregated counts per campaign and site — no per-person data, because there is none. |
Deletion is automatic and enforced by the database, not by a job somebody has to remember to run.
Your rights
Under GDPR and similar laws you may ask what data an organisation holds about you. Our honest answer is that our measurement data holds nothing that can be linked to you: there is no identifier to search by, so a request against it cannot be satisfied even in principle. If you can tell us an IP address and a narrow time window, we can check whether it appears in an infrastructure log still inside its retention window, and remove it.
If you believe otherwise, write to hello@pixtru.comand we will explain exactly what exists and how to verify it.