# Privacy

> The three privacy modes of a site, what Checkend keeps in each mode, and what it never keeps.

Checkend keeps as little data as possible. It never stores an IP address, a user agent or a raw visitor ID. The tracking script sets no cookies.

## The three privacy modes

Each site has one privacy mode. The mode is a named preset, not a set of separate switches.

| Mode | Visitor identity | Location kept |
|---|---|---|
| `strict` | No visitor ID. Counts only. | Country |
| `standard` (default) | A hash of the IP address, the user agent and a daily salt. | Country, region |
| `extended` | A persistent ID that you give. | City |

### Strict

Checkend keeps no visitor ID. It counts page views and events. It cannot count visitors or return visits. Conversions count each event, and the conversion rate divides by page views.

### Standard

Checkend makes a visitor ID from a hash of the IP address, the user agent and a daily salt. It then discards the IP address. Checkend deletes the salt each day, so the same person gets a new ID on the next UTC day. Checkend cannot connect the visits of two days.

This is the default mode.

### Extended

Checkend uses a persistent ID, so it can count return visits over many days and follow user funnels. The ID comes from one of two places:

- your own user ID, in the `data-uid` attribute of the script tag,
- a random first-party ID that the script keeps in `localStorage`, with the `data-persist` attribute.

Checkend stores only a hash of the ID, never the raw ID. Without a persistent ID, the event uses the standard visitor ID.

> **Caution**
> Check the law of your country before you use extended mode. A consent banner is probably necessary.

### Select a mode

```sh
ce sites add example.com --privacy strict
ce sites set example.com --privacy extended
```

## Rules for all modes

- Checkend never stores the IP address. It discards the IP address after the visitor hash and the location lookup.
- Checkend never stores the user agent or a raw visitor ID.
- Click IDs (`gclid`, `msclkid`, `fbclid`) mark a visit as paid. Checkend never stores their values.
- A web vitals report keeps the page and the numbers only: no visitor ID and no location.
- An access log push keeps only the hits of known crawlers: the day, the path without the query, the bot name and the status.

## Do Not Track and Global Privacy Control

When a visitor sends Do Not Track (DNT) or Global Privacy Control (GPC), Checkend still counts the page view, but it uses strict mode for that event. The event has no visitor hash and keeps the country only. This applies to every site, in every mode.

## Server events

A server can send a custom event with `POST /v1/events` or `ce event send`, for example a purchase from a payment webhook. The request comes from your server, not from the visitor. So the event keeps no location and no IP-based visitor hash. In extended mode, a `vid` gives a visitor ID.

## The data-center filter

Checkend drops events from hosting and cloud networks, because they are bots. It does not drop VPN networks: people who use a VPN count as people. The filter also drops known bot user agents and headless browsers.

To keep events from hosting networks, start the server with `--no-datacenter-filter`.

## Location data

Checkend finds the location with the DB-IP City Lite file. The file needs no license key. The server downloads it at the first start.

The data is licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/). Wherever you show location data from Checkend, show this attribution with a link:

> IP Geolocation by [DB-IP](https://db-ip.com)

## Custom event data

> **Caution**
> Do not put personal data (email addresses, names, user IDs) in event props. Checkend stores props as they are, for the full retention time.

## Data and AI

No analytics data leaves your server unless your own agent asks for it. Checkend has no AI inside, so it never sends data to an AI provider. See [No AI inside](/docs/concepts/no-ai-inside.md).

## Cookie banners

> **Caution**
> Do not use Checkend as a legal answer about cookie banners. Laws are different in each country. Read what data each mode keeps, and decide for your site.