Privacy and your data

odo is built to measure a website without following anyone around it. This page says exactly what it keeps.

About your visitors#

• One id, first-party. By default the script keeps odo_vid in a cookie and in local storage on your own domain, for a year from the visitor’s latest visit. It recognizes returning visitors, keeps experiments steady, and lets a checkout pass the visitor on so the sale can be traced. It’s never shared with other sites, and no other company’s script is involved.
• Cookieless sites, and browsers that send Global Privacy Control, store nothing. Visitors are counted by a hash of the site, their IP address and their browser, salted with a secret that’s replaced every day and then deleted, so one day’s visits can’t be linked to the next.
• No IP addresses and no full user agents are kept. Country, region and city come from your proxy’s headers (Cloudflare, Vercel, CloudFront) when there are any, else from the IP address, looked up as the visit arrives in DB-IP’s free database and then forgotten, else from the browser’s time zone. For the map, each visit keeps rough coordinates, rounded to about a city.
• Nothing anyone types. Clicks and forms are noted by what a button or field says about itself, never by what was entered, and nothing inside data-odo-ignore is read. See clicks, forms and errors.
• Heatmaps by place, not by content. A click is placed by where it lands on the page, never by what the page says there, and a screen is kept only as phone, tablet or desktop. See heatmaps.
• No bots. Automated and headless browsers aren’t counted.

About your buyers#

When a Stripe sale is traced to a visit, odo keeps the buyer’s name with it, or their email when Stripe has no name, as your Stripe knows them, so your dashboard can say who paid. That’s the only buyer odo keeps: no other platform’s, and none for a Stripe sale that isn’t traced.

Who sees what#

• You, and the people on your project, as their role allows, including who paid for a traced Stripe sale.
• Shared links and public pages show what you chose, never who paid, nor what events carry.
• The REST API returns numbers, never names, emails, visitor ids or addresses.
• Your AI assistant reads what you can read, who paid included, and only reads (but for noting site updates and running experiments, if you let it). Text from pages and browsers reaches it as data, never as instructions.
• odo’s analysis with Claude sends aggregates, never a visitor’s personal data. See analysis with Claude.

Your account#

Passwords are hashed with scrypt and checked against known breaches without leaving the server whole. Sessions and emailed links are random tokens, stored only as hashes. Keys you give odo for your sources are encrypted at rest and only ever used by its server. Two-factor authentication is in Settings → Account.

Keeping and deleting#

Your numbers stay as long as your account does: nothing is deleted when a trial or a plan ends. Plans say how long their data is kept at least: see plans and billing. Removing a website from odo deletes its visits, and removing a source stops reading it.