What RoutingCat collects

What RoutingCat records about your site’s visitors, by category, and exactly what it never stores: for your privacy policy and your content security policy.

The legal terms are RoutingCat’s Privacy Policy and its Data Processing Addendum, part of the Terms of Service.

What it records

RoutingCat records what it needs to route visitors and to measure what routing changes. The examples below show each category; they are not a complete list, and what RoutingCat reads may change between versions.

Category	For example	When
Request details	The time, the approximate location derived from the visitor’s IP address, the user agent, the visitor’s languages, and the page’s path with identifiers removed	Each arrival from outside your site, and each page load of a routed page
Device and browser	The screen size, the browser’s language and time zone, and whether it is on a phone	When a page shows, from RoutingCat’s browser code
Where visits came from	The referrer’s host, the landing page, campaign tags and ad click identifiers	Each arrival from outside your site
What was shown	The variant of each slot, whether the visitor is in the control, and what each slot rendered	Each page load of a routed page
Engagement	Whether each slot was seen and for how long, clicks inside it, scroll depth and the page’s web vitals	When a page shows, and each time it is hidden
The events you send	Their name, id, time, visitor and account ids, value, currency, items and properties, as your code sends them	Each `track` and `identify`

RoutingCat’s browser code is the script your head partial carries. It reads the request details in the page, the user agent and the languages from the browser, and RoutingCat derives the location from the IP address the page’s records arrive from.

Ad click identifiers, such as gclid and fbclid, are kept with their values, for RoutingCat’s own use: they never appear in anything RoutingCat shows you or lets you download.

What is never stored

A visitor’s full IP address. RoutingCat uses it in memory, to recognize the address ranges crawlers publish, then keeps only its network prefix: the first 24 bits of an IPv4 address, the first 48 of an IPv6 one. An address inside anything a browser sends is cut the same way.
Form contents and request bodies, authorization headers, and the contents of cookies other than RoutingCat’s own.
Query values, except campaign tags and ad click identifiers: other parameters keep only their names. A referrer keeps no query or fragment.
Identifiers in paths. A path segment that looks like an id, such as a long number or an email address, is replaced before it is stored.
Precise location. The browser is never asked for its position: location comes only from the IP address, approximately.
A fingerprint. RoutingCat never recognizes a visitor from their device or browser: a visitor is only the random id RoutingCat gives their browser, and nothing it records is combined to tell visitors apart.
Email addresses. RoutingCat asks for none, and identify warns when an account id holds @.

The events you send are kept as you send them, so keep personal data, such as email addresses, out of their properties.

Cookies

On your site, RoutingCat’s script writes rc_vid and rc_probe itself, and reads rc_fs, which the server helpers set if you add them, then deletes it. The rest of the visitor’s state lives in the browser’s storage, below.

Cookie	What it is for	Lifetime	Scope
`rc_vid`	The visitor id: random, and derived from nothing. RoutingCat’s script writes it from its copy in local storage, for your server and your subdomains	400 days, rewritten at each page view; Safari deletes it after 7 days without a visit, unless your server sets it, through the server helpers	Your registrable domain, so your subdomains share it; one host only on a hosting suffix, such as `*.pages.dev`, on a domain right under a two-part suffix, such as `example.co.uk`, on `localhost` and on an IP address. Readable by your browser code
`rc_probe`	A test of which domain `rc_vid` can cover, written and deleted at once	10 seconds at most	The domain tested
`rc_fs`	Whether the visitor typed the address, or followed a link from another site or from yours: set by the server helpers, if you add them, then read once and deleted by RoutingCat’s script	10 seconds	This host only. Readable by your browser code

Each is SameSite=Lax, and Secure on an https:// page.

Browser storage. The rest lives in the browser’s storage, which only pages of your own origin can read. In local storage:

Key	What it is for	Lasts
`rc.vid`	The visitor id, the copy `rc_vid` is written from	Until the browser clears it; Safari clears it after 7 days without a visit
`rc.ep`	The current visit, so that each routed page keeps showing the same variants during it	Until the visit ends: 7 days from its start, by default
`rc.arr`	The latest arrival from outside your site, so that a conversion can be credited to where the visit came from	24 hours from the arrival
`rc.b.<environment>.<page>`	A routed page’s routing data, so that later views decide at once	Used for a day, and refreshed as the page shows
`rc.ob`	The records a page couldn’t deliver, sent again at the next page	72 hours at most, and 20 records
`rc.exc`	A count of the errors RoutingCat’s script met before it decided, until a record carries it	Until it is sent
`rc.blk`	When a record last failed to reach RoutingCat from this browser	Until one gets through
`rc.dom`	The domain `rc_vid` covers on this host	Until the browser clears it
`rc.st`	The site’s routing status, so that a page whose routing data is old follows a pause	Used for 30 seconds

And in session storage, for the tab alone: rc.pv, a preview link’s token, for people who open one, until the link expires, within the hour; and rc.dev, the variants forced with ?rc=, in development only.

PostHog. On a site running PostHog, RoutingCat registers rc_vid and the variants shown as PostHog super properties, so PostHog stores them with its own data.

Requests your site makes

From	To	For	In a content security policy
Visitors’ browsers	`https://ingest.routingcat.com`	Records, beacons and the page’s events, sent straight from the page	`connect-src` lists it
Visitors’ browsers	`https://cdn.routingcat.com`	Each routed page’s routing data, the site’s routing status, and RoutingCat’s post part	`script-src` and `connect-src` list it
Your server and other backends, with the server events key	`ingest.routingcat.com`	Events and identity links	None: a policy governs browsers
`npx routingcat push`, in your CI, your host’s deploy script or on your machine	`api.routingcat.com`	Registering your templates	None

A policy must also allow the head partial’s core, an inline script, by the page’s nonce on the partial’s script tags, which push keeps, or by its hash in script-src, which an upgrade of routingcat can change; its style rules, by the same nonce or with 'unsafe-inline' in style-src, since a policy that allows inline styles only by hash leaves every visitor on your defaults; and each slot’s style="display:contents", with 'unsafe-hashes' and its hash in style-src-attr, or slots render as boxes. doctor names each source your policy lacks.

Retention and deletion

Retention. RoutingCat keeps a site’s records while the site is active. Archiving the site closes it: collection stops, and its records are deleted within 90 days, unless you ask otherwise.
Deletion. Write to privacy@routingcat.com to delete one visitor or one account, by its id, or your whole site. Each request is handled within 30 days. Deleting a visitor or an account removes its records and recomputes your results; deleting your whole site keeps only its results, as totals with no visitor’s row. Models already trained keep what they learned.

Data use

No identity across sites. A visitor id is random for each site and shared with none. RoutingCat builds no profile of a person across sites, and never matches visitors by IP address or by likelihood: a person’s devices link only through the account ids you send.
Improving RoutingCat. RoutingCat uses the data it processes to run the service and to improve it, including the models that serve all customers. Nothing that identifies your visitors or your business is shared with another customer.

Every visitor gets the rc_vid cookie, whatever consent your site collects. RoutingCat records the Global Privacy Control and Do Not Track signals, and doesn’t act on them.

Your team

For the people who use RoutingCat, it keeps each member’s email address: to invite them, to match their sign-in, which runs through Clerk, and to send RoutingCat’s emails, through Resend. The plan’s payments go through Stripe, which keeps the owner’s card, and gets their email address for its receipts and invoices. Of the card, RoutingCat keeps only its brand, its last four digits and its expiry date, to show which card is on file.