# Privacy and your data

> What odo stores about your visitors and buyers, and what it never does: the one first-party id, cookieless mode, IP addresses, typed text, and who sees what.

odo is built to measure a website without following anyone around it. This page says exactly what it keeps.

> This describes how odo works. It isn’t legal advice about what your site needs: that depends on where you and your visitors are. Our article [do you need a cookie banner?](https://odo.gg/articles/do-you-need-a-cookie-banner) goes through the questions.

## About your visitors

- **One id, first-party.** By default the script keeps `odo_vid` in a cookie and in local storage on your own domain, for a year from the visitor’s latest visit. It recognizes returning visitors, keeps experiments steady, and lets a checkout pass the visitor on so the sale can be traced. It’s never shared with other sites, and no other company’s script is involved.
- **Cookieless sites, and browsers that send Global Privacy Control,** store nothing. Visitors are counted by a hash of the site, their IP address and their browser, salted with a secret that’s replaced every day and then deleted, so one day’s visits can’t be linked to the next.
- **No IP addresses** and no full user agents are kept. Country, region and city come from your proxy’s headers (Cloudflare, Vercel, CloudFront) when there are any, else from the IP address, looked up as the visit arrives in DB-IP’s free database and then forgotten, else from the browser’s time zone. For the map, each visit keeps rough coordinates, rounded to about a city.
- **Nothing anyone types.** Clicks and forms are noted by what a button or field says about itself, never by what was entered, and nothing inside `data-odo-ignore` is read. See [clicks, forms and errors](https://odo.gg/docs/interactions).
- **Heatmaps by place, not by content.** A click is placed by where it lands on the page, never by what the page says there, and a screen is kept only as phone, tablet or desktop. See [heatmaps](https://odo.gg/docs/heatmaps#whats-never-recorded).
- **No bots.** Automated and headless browsers aren’t counted.

## About your buyers

When a Stripe sale is traced to a visit, odo keeps the buyer’s name with it, or their email when Stripe has no name, as your Stripe knows them, so your dashboard can say who paid. That’s the only buyer odo keeps: no other platform’s, and none for a Stripe sale that isn’t traced.

## Who sees what

- **You, and the people on your project,** as their role allows, including who paid for a traced Stripe sale.
- **Shared links and public pages** show what you chose, never who paid, nor what events carry.
- **The REST API** returns numbers, never names, emails, visitor ids or addresses.
- **Your AI assistant** reads what you can read, who paid included, and only reads (but for noting site updates and running experiments, if you let it). Text from pages and browsers reaches it as data, never as instructions.
- **odo’s analysis with Claude** sends aggregates, never a visitor’s personal data. See [analysis with Claude](https://odo.gg/docs/analysis).

## Your account

Passwords are hashed with scrypt and checked against known breaches without leaving the server whole. Sessions and emailed links are random tokens, stored only as hashes. Keys you give odo for your sources are encrypted at rest and only ever used by its server. Two-factor authentication is in **Settings → Account**.

## Keeping and deleting

Your numbers stay as long as your account does: nothing is deleted when a trial or a plan ends. Plans say how long their data is kept at least: see [plans and billing](https://odo.gg/docs/plans). Removing a website from odo deletes its visits, and removing a source stops reading it.