Data kept and privacy
What FirstMRR stores for each event, for how long, and what is never accepted.
What is kept
- The event type, its name for a custom event, the page (without parameters), the referring host,
utm_source, the device type. - The app whose browser opened the page (TikTok, Instagram…), the tracked link slug, the "Where did you hear about us?" answer and the account named.
- For a payment: the amount, the currency and a hash of its id (only used to never count it twice).
- A/B variants (test and variant names).
- A visitor: a hash computed every day with a changing key, from the tab id, the app's install id or, for an older script, the IP address and browser. Neither the IP address, the id nor the browser is kept.
Events are kept 25 months at most. Secret keys are kept as a hash, with their first 16 characters to tell them apart.
What is never accepted
- No cookie, no advertising id (IDFA, AAID), no device fingerprint.
- No e-mail, name or account id: the API refuses any field outside the schema, and an e-mail given as an account is rejected.
- Visitors who send Global Privacy Control or Do Not Track, or who clicked your opt-out link, are not measured.
For your visitors, you are the controller and FirstMRR acts on your behalf: mention the measurement in your privacy policy. Details: Privacy and security.