What we collect
Every field the Wholetally script and edge collector send, and what we keep. If it isn’t on this page, we don’t collect it.
Sent by the script
The script sends one small request per pageview or event. These are all the fields in it.
| Field | What it is | What we store |
|---|---|---|
t | Hit type: pageview or event | Yes |
s | Your site’s domain, as set in data-site | Yes |
u | The page URL. We keep the path and UTM tags; other query parameters are dropped | Path and UTM tags only |
r | The referrer, the page the visitor came from | Hostname, and whether the visit is unique |
w | Window width in pixels | As a bucket: mobile, tablet or desktop |
l | Browser language, such as nl-NL | Yes |
n, p | Event name and properties, only when you call wt.track() | Yes |
rid | Request ID set by the edge collector, used to match script and edge hits | Only until the match is made |
Added by the server
Every request carries some information by itself. This is what we do with it.
| Field | What it is | What we store |
|---|---|---|
Country | From the country header your CDN or proxy adds (such as CF-IPCountry). We don’t look up IP addresses | Country code |
User agent | Sent by every browser with every request | As browser, OS, device type, or crawler name |
IP address | Seen by the server that receives the request. When you use the first-party proxy, it doesn’t reach us at all | Never |
Time | When the hit arrived | Yes |
Sent by the edge collector
Only if you install the Cloudflare Worker or Vercel middleware.
| Field | What it is | What we store |
|---|---|---|
Path | The page that was served | Yes |
User agent | To tell people from crawlers | As browser, OS, device type, or crawler name |
Country header | The country your CDN already determined | Country code |
Referrer | Only if the browser sent one | Hostname |
Request ID | To deduplicate against the script | Only until the match is made |
Revenue events
Only if you connect Stripe.
| Field | What it is | What we store |
|---|---|---|
Amount and currency | From the verified Stripe webhook | Yes |
wt_source, wt_medium, wt_campaign, wt_landing | The visit’s source, passed by your checkout as metadata | Yes |
Payment ID | To handle refunds and avoid counting a payment twice | Yes |
Customer name, email, card details | Part of the payment, but not something we need | Never read or stored |
What we never do
- Set cookies, or use localStorage, sessionStorage or any other storage on the visitor’s device.
- Create a visitor, user or device ID, or fingerprint a browser.
- Store IP addresses.
- Sell data or use it for advertising.
Optional: daily hash mode
Off by default. If you turn it on for a site, the server combines the site, IP address and user agent with a salt that changes every 24 hours, and keeps only the resulting hash. The salt is thrown away when it changes, so yesterday’s hash can’t be linked to today’s. It gives a better count of unique visitors within one day. The strict compliance mode doesn’t allow it.
Retention and location
You choose how long raw hits are kept for each site; daily totals can be kept longer. All data is planned to be stored and processed in the EU. The script is open source under the MIT licence, so you can check every line it runs.
Designed to work without cookies and without personal data. Whether you need a consent banner depends on your country and how you use it. This may let you skip the banner in some EU countries, but check with your legal advisor. Legal review pending.
Count the visitors you’ve been missing.
30-day free trial, no card needed. Create an account with your work email and add your first site.