Privacy
What Lynq stores, and what it never does.
Lynq measures a website without following the people who use it. This page lists exactly what a visit leaves behind. It is short because the list is.
A visit, as stored
Every pageview becomes one row: the page and its query string, where the visitor came from, the country, region and city from the request, the device, browser and operating system, the screen and viewport size, the language, how long the page was engaged with and how far it was scrolled. Page titles are off unless the site turns them on.
Custom events add their name and the properties the site chose to send. Web Vitals add timings. That is the whole row.
7f3a9c2e41b8d605 re-salted every dayWho a visitor is
A visitor number is computed when the request arrives, from the IP address, the browser's user agent, the site, and a random salt that changes every day. The IP address is used for that computation and for the country lookup, then dropped. It is never written anywhere.
Because the salt changes daily, the same person produces a different number tomorrow. Lynq can count a returning visitor within a day and cannot recognise them across days.
Nothing in the browser
Lynq sets no cookies. The script keeps one record in the tab's session storage so a visit can be counted as one session; it is gone when the tab closes. The only thing that persists is an opt-out flag, and only if the visitor sets it.
No canvas, font, or audio fingerprinting. Nothing is read from the browser beyond the screen size, the viewport, and the language.
If a site identifies its users
A site can call lynq.identify(id) for its own logged-in users. The id is hashed with a per-site secret before it is stored; the hash is what the reports use. The raw id is kept for 90 days only if the site turns that on, and is off by default.
Global Privacy Control and Do Not Track
A browser that sends Global Privacy Control is always treated as anonymous: pageviews are counted, and identify calls are ignored. There is no switch to turn this off.
Do Not Track is honoured when the site asks for it with data-respect-dnt on the script tag, in which case the script sends nothing at all.
What a site owner controls
Retention: events are kept for 24 months by default and removed after that; the owner can shorten it. Exclusions: the owner can exclude their own IP addresses and any paths, and those visits are never recorded. Export: any table exports as CSV. Deletion: deleting a site removes every one of its events.
Where it lives
Events are stored for the site's reports and for nothing else. Aggregates are the only thing the reports read; nothing is sold, shared, or used for anything but the site's own reports.
The tracker's documentation describes every attribute the script accepts.