Browser privacy modes
Choose Settings → Data → Browser collection for copyable HTML, React or Next.js instructions. Changing the selection only generates code: update your website installation to apply it. This configures the browser SDK, independently of server instrumentation.
| Behavior | Persistent (default) | Short-lived (ephemeral) |
|---|---|---|
| Tracking identifiers | Local storage and optional cookie | Memory only |
| Identity lifetime | Survives reloads | Fresh on reload, idle timeout or 30-minute absolute age |
| Identify / alias | Supported | Ignored |
| Returning-user, retention and cross-visit attribution | Supported when identities can be joined | Cannot reliably connect separate identities |
| Flag assignment cache | Local storage | Current memory identity only |
| Ad click IDs / ad cookies | Configurable | Disabled |
| Automatic URL query / fragment | Included | Removed |
| Consent and opt out | Explicit controls | Same controls |
import { spm } from "@saaspro/browser";
spm.init({
key: "spm_pub_prod_xxxxxxxx",
privacyMode: "ephemeral",
captureText: false,
consent: "pending",
});
// Wire these to your existing consent controls and saved consent choice.
function allowAnalytics() { spm.consent("granted"); }
function declineAnalytics() { spm.consent("revoked"); }
The script equivalent is data-privacy-mode="ephemeral". React's SaaSProMaxProvider accepts the same config property. Initialize once per page; changing provider props does not reconfigure an existing client.
Short-lived mode forces cookieless operation and disables ad click ID collection. cookieless: true alone still uses local storage and is not this mode. The idle window is clamped to 1–30 minutes; activity cannot extend identity past 30 minutes. Clock rollback also rotates it. Identity expiry is checked on the next event or identity/flag access. Buffered events keep the identity under which they were captured. Flags must be loaded again after rotation; assignments may change.
When consent is granted, the SDK removes its old host-local tracking keys (spm_aid, spm_did, spm_sid, spm_attr, spm_flags) and anonymous-id cookie. It does not read them for tracking, even while consent is pending. New tracking state is never persisted. Existing opt-out preferences remain respected; explicit optOut() persists that preference. Pending consent buffers at most 500 events in memory; revocation discards the buffer and clears identity. Already received events remain subject to application retention and deletion controls.
Automatic page/referrer, outbound-link and network-breadcrumb URLs omit query strings and fragments. Error request URLs are also stripped. UTM campaign labels and page paths still exist. Custom event properties, explicit context/attribution, error messages, source frames, fingerprints and manually supplied breadcrumbs can contain personal data: redact or omit these at instrumentation. captureText: false disables automatic visible-text capture. This mode controls browser identity; it is not a complete anonymizer or a determination of consent requirements.
Verify
After allowing collection, open Analytics → Live and inspect an event for $privacy_mode: ephemeral. Reload the website and check that spm.getAnonymousId() changes. SDK tracking keys should be absent in local storage and cookies; an opt-out preference is an intentional exception. Use property filters on $privacy_mode to isolate these observations. Counts represent temporary identities, not unique people across visits. There is no browser identity link to a signed-in customer or verified revenue in this mode.
Every web development start and production build builds the browser SDK and copies its IIFE to /spm.js. The asset supports cross-origin script loading and uses a five-minute cache lifetime. For a strict site CSP, authorize the script source (or nonce) and the configured ingest host under connect-src. Snippets served from your own origin must include data-host.