What RoutingCat collects
What RoutingCat records about your site’s visitors, by category, and exactly what it never stores: for your privacy policy and your content security policy.
The legal terms are RoutingCat’s Privacy Policy and its Data Processing Addendum, part of the Terms of Service.
What it records
RoutingCat records what it needs to route visitors and to measure what routing changes. The examples below show each category; they are not a complete list, and what RoutingCat reads may change between versions.
| Category | For example | When |
|---|---|---|
| Request details | The time, the approximate location derived from the visitor’s IP address, the user agent, the visitor’s languages, and the page’s path with identifiers removed | Each arrival from outside your site, and each page load of a routed page |
| Device and browser | The screen size, the browser’s language and time zone, and whether it is on a phone | When a page shows, from RoutingCat’s browser code |
| Where visits came from | The referrer’s host, the landing page, campaign tags and ad click identifiers | Each arrival from outside your site |
| What was shown | The variant of each slot, whether the visitor is in the control, and what each slot rendered | Each page load of a routed page |
| Engagement | Whether each slot was seen and for how long, clicks inside it, scroll depth and the page’s web vitals | When a page shows, and each time it is hidden |
| The events you send | Their name, id, time, visitor and account ids, value, currency, items and properties, as your code sends them | Each track and identify |
The request details come from each request the middleware or the Worker handles, the location as your host derives it from the IP address. RoutingCat’s browser code is its module’s client plugin, which runs on every page.
Ad click identifiers, such as gclid and fbclid, are kept with their values, for RoutingCat’s own use: they never appear in anything RoutingCat shows you or lets you download.
What is never stored
- A visitor’s full IP address. RoutingCat uses it in memory, to recognize the address ranges crawlers publish, then keeps only its network prefix: the first 24 bits of an IPv4 address, the first 48 of an IPv6 one. An address inside anything a browser sends is cut the same way.
- Form contents and request bodies, authorization headers, and the contents of cookies other than RoutingCat’s own.
- Query values, except campaign tags and ad click identifiers: other parameters keep only their names. A referrer keeps no query or fragment.
- Identifiers in paths. A path segment that looks like an id, such as a long number or an email address, is replaced before it is stored.
- Precise location. The browser is never asked for its position: location comes only from the IP address, approximately.
- A fingerprint. RoutingCat never recognizes a visitor from their device or browser: a visitor is only the random id RoutingCat gives their browser, and nothing it records is combined to tell visitors apart.
- Email addresses. RoutingCat asks for none.
The events you send are kept as you send them, so keep personal data, such as email addresses, out of their properties.
Cookies
RoutingCat’s cookies are written by your site’s responses, through the middleware or the Worker, never by browser code. A visitor gets three at most; rc_pv and rc_dev are only for people previewing or developing.
| Cookie | What it is for | Lifetime | Scope |
|---|---|---|---|
rc_vid |
The visitor id: random, and derived from nothing. Every visitor gets it, on every page RoutingCat runs before | 400 days, renewed at each page load | Your registrable domain, so your subdomains share it; one host only on a hosting suffix, such as *.vercel.app, *.workers.dev or *.pages.dev, on localhost and on an IP address. Readable by your browser code |
rc_ep |
The current visit, so that each routed page keeps showing the same variants during it | Until the visit ends: 7 days from its start, by default | This host only; not readable by browser code |
rc_arr |
The latest arrival from outside your site, so that a conversion can be credited to where the visit came from | 24 hours from the arrival | This host only; not readable by browser code |
rc_pv |
A preview link’s signed token, for people who open one | The link’s remaining time, at most 1 hour | This host only; not readable by browser code |
rc_dev |
The variants forced with ?rc=, in development only |
The browser session | This host only; not readable by browser code |
Every cookie is SameSite=Lax, and all but rc_dev are Secure, since a development server serves plain HTTP.
Browser storage. RoutingCat keeps nothing else in the browser.
PostHog. On a site running PostHog, RoutingCat registers rc_vid and the variants shown as PostHog super properties, so PostHog stores them with its own data.
Requests your site makes
| From | To | For | In a content security policy |
|---|---|---|---|
| Visitors’ browsers | Your own site’s /_rc path, which the middleware or the Worker forwards to ingest.routingcat.com |
Beacons, and the next page’s variants on an in-page navigation | connect-src 'self' covers it |
| Your server: the build, and the middleware or the Worker | api.routingcat.com and ingest.routingcat.com |
Routing data, the build’s registration, and records | None: a policy governs browsers |
| Your other backends, with the server events key | ingest.routingcat.com |
Events and identity links | None |
A policy must also allow the head snippet, an inline script, by the page’s nonce on its tag or by its hash in script-src; the style rules it writes, by the same nonce or with 'unsafe-inline' in style-src; and each slot’s style="display:contents", with 'unsafe-hashes' and its hash in style-src-attr. Run it in production gives each, and doctor names what your policy lacks.
Retention and deletion
-
Retention. RoutingCat keeps a site’s records while the site is active. Archiving the site closes it: collection stops, and its records are deleted within 90 days, unless you ask otherwise.
-
Deletion. Write to privacy@routingcat.com to delete one visitor or one account, by its id, or your whole site. Each request is handled within 30 days. Deleting a visitor or an account removes its records and recomputes your results; deleting your whole site keeps only its results, as totals with no visitor’s row. Models already trained keep what they learned.
-
Routing data. When your whole site’s records are deleted, after its archive or at your request, its routing data goes with them, and
api.routingcat.comstops serving it within 15 seconds.
Data use
- No identity across sites. A visitor id is random for each site and shared with none. RoutingCat builds no profile of a person across sites, and never matches visitors by IP address or by likelihood: a person’s devices link only through the account ids you send.
- Improving RoutingCat. RoutingCat uses the data it processes to run the service and to improve it, including the models that serve all customers. Nothing that identifies your visitors or your business is shared with another customer.
Consent
Every visitor gets the rc_vid cookie, whatever consent your site collects. RoutingCat records the Global Privacy Control and Do Not Track signals, and doesn’t act on them.
Your team
For the people who use RoutingCat, it keeps each member’s email address: to invite them, to match their sign-in, which runs through Clerk, and to send RoutingCat’s emails, through Resend. The plan’s payments go through Stripe, which keeps the owner’s card, and gets their email address for its receipts and invoices. Of the card, RoutingCat keeps only its brand, its last four digits and its expiry date, to show which card is on file.