Exactly what BobRay collects (and never collects)

Trust needs specifics. This is the complete inventory of what a BobRay pageview contains, what is derived and discarded, and what never exists at all.

• Key takeaways
• Per view: URL, referrer, reduced user-agent, screen class, site ID, day token.
• IP is used in memory for country + token, then discarded, never stored.
• No cookies, no fingerprinting, no identifiers, on any plan, ever.

Sent with each pageview

• Page URL and referrer URL (with common tracking parameters stripped).
• User-agent string, reduced immediately to browser family and device class.
• Screen class (mobile / tablet / desktop breakpoint, not exact resolution).
• Your site ID and an anonymous, day-scoped visit token derived server-side.

Derived then discarded

The connecting IP address is used in memory for two things, a country-level lookup and the day-scoped token derivation, then discarded. It is never written to disk, never stored, never recoverable.

Never collected

• No cookies or localStorage on visitors' devices, ever.
• No fingerprinting: no canvas, fonts, audio, or hardware probing.
• No names, emails, or identifiers of your visitors.
• No cross-site profiles, tokens cannot link a person between two BobRay customers, or even between two days on the same site.

Where it lives

All processing and storage happens in EU data centers. Details on legal roles and paperwork are in GDPR and BobRay and the DPA.

Common pitfalls

The mistakes we see most often on this topic, so you can skip them entirely.

• Sending personal data in event metadata, don't; metadata must stay non-personal.
• Assuming 'anonymized IP' storage like other tools; we store no IP at all.
• Looking for city-level geo; country is the deliberate maximum.

Quick reference