# Security & Privacy

> Configure Databuddy's collection controls, visitor IDs, opt-out behavior, origin checks, and IP restrictions.


Databuddy provides cookieless collection and controls for the information you send. This page describes those controls and their limits. See the [Privacy Policy](/privacy) and [Data Processing Agreement](/dpa) for our data-protection commitments.

## Privacy-First Design

The browser tracker uses first-party localStorage for visitor information and sessionStorage for sessions. Session IDs use a 30-minute reuse window; a continuously open page can keep its current session longer.

Standard analytics event records omit raw IP addresses after request handling and approximate country, region, and city lookup. By default, ingestion hashes visitor IDs with a rotating daily salt. Your website's `anonymizeVisitorIds` setting can disable that transformation or apply it according to the visitor's country.

The [identify API](/docs/sdk/identify-users) links activity to profile IDs and traits you supply. Profile IDs are separate from visitor-ID anonymization. Page paths, titles, custom properties, and errors can also contain personal information; review those payloads before sending them.

## Privacy Controls

Enable the features you need using the [SDK configuration](/docs/sdk/configuration). For example, this configuration disables errors, outgoing-link events, and performance collection:

```tsx
import { Databuddy } from "@databuddy/sdk/react";

<Databuddy
  clientId="YOUR_WEBSITE_ID"
  trackWebVitals={false}
  trackOutgoingLinks={false}
  trackErrors={false}
/>;
```

This is a collection example, not a consent configuration. Where prior consent is required, delay mounting the component or loading the script until consent is granted.

### Local Data Storage and Opt-Out

The browser tracker honors Global Privacy Control, Do Not Track, and the stored opt-out preference. Its built-in helpers are:

```javascript
window.databuddyOptOut();
window.databuddyOptIn();
```

Opting out stops tracking, clears local tracker identifiers, and stores the preference when localStorage is available. Opting in does not override GPC or DNT. These helpers do not delete information already collected on the server.

### Data Deletion in Practice

Visitors should contact the website owner about collected information. We assist customers with access, correction, and deletion requests; contact [privacy@databuddy.cc](mailto:privacy@databuddy.cc). Hashing an identifier or leaving identification disabled does not guarantee that no personal data was collected.

## Access Control Settings

Collection requires an active website ID. Origin filtering is an ingestion control, not proof of domain ownership: a non-browser client can supply an Origin header.

Open your website's **Settings → Security** to configure additional allowed origins and IP restrictions.

### Allowed Origins

When a request includes an Origin, the registered hostname and its subdomains are accepted by default. Additional allowed origins broaden that set; they cannot exclude the registered domain.

Without a configured list, requests lacking an Origin are accepted. With a nonempty list, a missing or unrecognized Origin produces a 403 response.

Supported entries include:

- `example.com`: the hostname.
- `*.example.com`: the apex and its subdomains.
- `localhost`: local development.
- `*`: any parseable origin.

Matching uses the hostname, not a particular scheme or port. The origin check does not itself enforce HTTPS.

### Allowed IP Addresses

An empty list imposes no IP restriction. A configured list accepts only requests with a trusted matching IP address; other requests receive a 403 response.

Supported entries include individual IPv4 or IPv6 addresses and IPv4 CIDR ranges, such as `192.0.2.10` or `192.0.2.0/24`.

This path uses the trusted `cf-connecting-ip` header. It does not fall back to arbitrary `x-forwarded-for` or `x-real-ip` values. With `SELFHOST=true`, configured IP allowlists reject requests rather than trusting potentially spoofed proxy headers.

Test restrictions with the actual clients and infrastructure that will send events. Blocking legitimate sources prevents their data from being collected.

## Data Protection

Requests are validated, size-limited, and rate-limited. Profile display names and email addresses use AES-256-GCM field encryption when the server key is configured; production ingestion requires that key. Arbitrary event properties and profile traits are outside this field-encryption mechanism.

Infrastructure, AI, billing, and delivery services process information needed for the features you enable. See the [Data Policy](/data-policy) for their roles.

## Privacy Compliance

Cookieless collection does not automatically remove consent requirements. Review browser storage, the information collected, and applicable rules. See the [web analytics privacy guide](/docs/compliance/gdpr-compliance-guide).

## Implementation Security

### Content Security Policy

Allow the tracker CDN in `script-src` and the configured ingestion endpoint in `connect-src`. For the default hosted endpoints, those are `https://cdn.databuddy.cc` and `https://basket.databuddy.cc`. Merge these into your existing policy; do not replace your application's other restrictions.

## Support & Questions

- [privacy@databuddy.cc](mailto:privacy@databuddy.cc) for privacy and data requests.
- [Getting Started](/docs/getting-started) for installation.
- [SDK Configuration](/docs/sdk/configuration) for collection options.