# GDPR-friendly by design > How PilotFox's design helps you run analytics under the GDPR, what you still decide, and how to answer a person's request to see or erase their data. PilotFox is built to collect as little personal data as analytics needs, and to help you answer the people it is about. This page explains each design choice, what remains your decision, and how to handle people's requests. It describes the product, not your obligations: whether your use of PilotFox meets the GDPR depends on your website, your visitors and how you set PilotFox up. Under the GDPR, you are the controller of the data PilotFox collects on your website and we, PilotFox, are your processor, under the [Data Processing Agreement](https://pilotfox.app/dpa). ## How the design helps ### No cookies The tracking script sets no cookies, and PilotFox reads none when it records a visit. It writes to the browser's storage only when you identify a user, when a visitor opts out, when a page is opened with `?pilotfox_ignore=true`, and on websites with session replay on: the [Cookie Policy](https://pilotfox.app/cookies#on-websites-that-use-pilotfox) lists every key. ### IP addresses are never stored The visitor's IP address is used while a request is processed: to compute the visitor id, to look up the approximate location, for bot checks, exclusions and rate limits. Then it is dropped. It is never stored with events, in sessions, in session recordings, in the bot report or in logs; rate limits keep a keyed hash of it for a short time. Locations are looked up in a database on PilotFox's own servers, so the address is not sent to another service for that. ### A visitor id per website, rotating daily if you like The server derives each visitor id from a secret random value kept per site, the site's id, the IP address and the browser's user agent, and keeps 8 bytes of the hash. Because the secret differs per site, the same person gets unrelated ids on two websites, and the ids cannot be linked. The browser never sees its id. In **daily** mode (Site settings → Privacy & identity) the secret changes every day at midnight UTC, so a browser gets a new id every day: the most private choice, at the cost of returning-visitor and retention figures. ### Little data by default - **Query strings**: keep all parameters, only campaign parameters, or none, and remove up to 50 named parameters (such as `token` or `email`) before anything is stored. - **Payment pages**: on a payment provider's return page, the script removes `email` and `license_key` from the address before sending it. - **Location**: country, region and city, with coordinates rounded to about 1 km. - **Browser**: its name and major version only. - **No form contents**: field values, typed text and copied text are never recorded in events. Clicks, form submissions, field changes, copies, JavaScript errors and web vitals are captured only once you turn each on, and automatic events carry a few properties each (for a field, its name and type, never its value). - **Buyers' emails**: payments from Stripe, Dodo Payments or Polar are stored without the buyer's email unless you turn on *Store customer emails*. ### Global Privacy Control and opt-out Browsers that send the Global Privacy Control signal are not tracked: no events, no identify, no recording. This is on by default. `pilotfox.optOut()` stops tracking in a browser, for example from your own consent banner, and `pilotfox.optIn()` undoes it. See [Opt-out and Global Privacy Control](https://pilotfox.app/docs/privacy#opt-out-and-global-privacy-control). ### Session replay off until you turn it on Session replay records nothing until you turn it on for a site. Then every input is masked by default and password fields always are; hidden and file inputs, CSRF tokens and canvas content are never recorded, and you can mask or leave out any element. ### Retention limits Session recordings are deleted after 30 days and requests from bots after 90 days. Events stay until you erase the person they belong to or delete their site, and backups of the databases are deleted after 30 days. ### Access only for those who need it Each member has one of five roles and can be limited to some sites. Sessions, user ids, query strings and buyers' emails are shown only to roles that may read sessions. API keys can be read-only and limited to some sites. Share links show one site and include sessions, users or replays only if you choose so. Credentials you connect are stored encrypted, and API keys and link tokens as hashes. ### Erasure and export *Delete user data* erases one person's events, sessions, recordings, identity links and traits from a site, in the dashboard or through the API. Deleting a site erases all its data. Site settings → Import & export downloads a site's raw events. See [Handling people's requests](#requests). ### A data processing agreement Our [Data Processing Agreement](https://pilotfox.app/dpa) sets out what we do with your visitors' data, as GDPR Art. 28 requires, and the kinds of [subprocessors](https://pilotfox.app/subprocessors) we use are listed. ### Running PilotFox yourself PilotFox can also run on your own servers, where your visitors' data never reaches us. Write to [hello@pilotfox.app](mailto:hello@pilotfox.app) for the self-hosting guide. ## What you still decide PilotFox's design limits what is collected; it does not make every use lawful. As the controller, you decide: - **Your lawful basis** (GDPR Art. 6) for analytics, for example legitimate interests or consent. - **Consent where your law requires it.** Rules on storing or reading information on visitors' devices, such as the ePrivacy Directive in the EU, can apply without cookies too, and features such as session replay or identifying users may need consent where you are. To track only after consent, load the script after it, or call `pilotfox.optOut()` until it is given. - **Your privacy notice** (Art. 13): that you use PilotFox as your processor; what is collected (see [Privacy and data](https://pilotfox.app/docs/privacy)); why; how long you keep it; and how visitors can opt out and exercise their rights. - **What you send.** Do not put special categories of data, passwords or payment card numbers in events, traits, user ids or page addresses. Strip query parameters that can hold personal data. - **Your settings**: daily or stable visitor ids, query strings, Global Privacy Control, session replay and its masking, customer emails, and which members may see what. - **Your records** of processing (Art. 30), and a data protection impact assessment where one is needed (Art. 35). The [Data Processing Agreement](https://pilotfox.app/dpa#security) describes PilotFox's security measures for them. ## Handling people's requests ### Someone you identified If you call `identify` with your own user id, you can find that person by it: - **Access**: the Users report shows their profile, traits, sessions and every event of each session. The same data is available through the [API](https://pilotfox.app/docs/api). - **Erasure**: on their page in the Users report, *Delete user data* (editors and above), or `DELETE /api/v1/sites/{siteId}/users/{userId}`. A background job erases their events and sessions (and those of the visitors linked to them), their recordings, identity links, profile and traits. Their payments stay in your revenue totals but lose every link to them, their visits and their email. Erase them on each site where you identified them. - **Portability**: Site settings → Import & export downloads a site's raw events as JSON Lines, from which you can take one person's rows. ### An anonymous visitor A visitor who was never identified is known only by a visitor id that the server computes and the browser never sees. Nothing a visitor can tell you, their IP address included, leads to their rows: the address is not stored, and the id cannot be computed outside PilotFox. So you usually cannot single them out. Tell them how to opt out (`pilotfox.optOut()` or Global Privacy Control). ### Objection A visitor who objects can be opted out in their browser with `pilotfox.optOut()`, for example from a link or a consent banner on your website. ## Where the data is PilotFox at pilotfox.app runs on the servers of a hosting provider, with file storage and email delivery from other providers: [Subprocessors](https://pilotfox.app/subprocessors) lists what each kind receives, and we name the providers and where they process data on request. Where one processes personal data outside the European Economic Area or the UK, we rely on an adequacy decision or on standard contractual clauses. Questions about PilotFox and the GDPR: [hello@pilotfox.app](mailto:hello@pilotfox.app).