# Data and privacy

> What the widget collects, where it goes, how long events and recordings are kept, and what consent mode changes.

This page describes what the GeoEngage widget collects from your visitors, where it goes, how long it's kept and what changes with consent. The legal terms are in the [Privacy Policy](https://geoengage.app/privacy-policy).

## What the widget collects

| What | When | What it holds |
| --- | --- | --- |
| Page views | Every page, and every route change in a single-page app | The visitor's random ID and session ID, the page, where the visit came from, device type, browser, the IP address and the approximate location worked out from it: country, state, city, postal code and coordinates. |
| Attention | Every page | How far down the page the visitor got, and how long they were active on each part of it. |
| Clicks | When click tracking is on | The element's tag, id and classes, the first 50 characters of its text, its link address, and where on the page the click landed. |
| Form submissions | When form tracking is on | The form's id, action and method, and how many fields it has. Not what was typed. |
| Rule activity | When a rule runs | Which rule, which action, which A/B variant, and whether the visitor is in the [holdout](https://geoengage.app/docs/rules/holdouts). |
| Goals and your own events | When they happen | Goal completions, and the events and conversions your own code sends with [`trackEvent` and `trackConversion`](https://geoengage.app/docs/widget/methods). |
| An email address | Only when your code calls `identify(email)` | The address you pass, sent with every event until you call `clearIdentity()`. See [Identity and storage](https://geoengage.app/docs/widget/storage#identifying-visitors). |

For where a visit came from, the widget keeps only the campaign parameters in an address, such as the `utm_` tags. Other parameters are dropped before anything is sent.

Your dashboard's **Data Schema** page lists every event type and field.

The widget writes no cookies. What it keeps in the visitor's browser is listed in [Identity and storage](https://geoengage.app/docs/widget/storage).

## Session recordings

Recording is off until you switch it on under **Tracking Config → Recording**. When it's on, a recording holds what the page looked like, the visitor's scrolling, clicks and page changes, the page's console messages, and the network requests the page makes.

- **Typed text is masked.** Everything typed into form fields is replaced before it leaves the browser. You can mask or block more with [Mask Selectors and Block Selectors](https://geoengage.app/docs/analytics/sessions#privacy).
- **Network requests are recorded with their addresses and, up to 10 KB each, their request and response bodies.** Credential headers and cookies are dropped. Query parameters and body fields with names like `token`, `password`, `secret` or `api_key` are masked.
- **Masking by name has a limit.** A field with an ordinary name that carries personal data isn't masked. Put `data-no-record` on pages or sections where that can happen.

## Where it goes

The widget talks to GeoEngage in two directions:

1. **In:** your published rules and tracking settings, fetched on each page view. The visitor's location is worked out from their IP address at the same time.
2. **Out:** the events above, and recordings if you've turned them on, sent from the visitor's browser to GeoEngage. Events and recordings are stored separately.

GeoEngage doesn't sell this data. It's shared only with the service providers that help run the platform, as the Privacy Policy describes.

## How long it's kept

| What | How long |
| --- | --- |
| Events, including any visitor email | The same on every plan: as long as the longest analytics history GeoEngage offers, then deleted within 100 days. Plans differ only in how far back the dashboard looks. |
| Session recordings | 60 days. |
| In the visitor's browser | Saved rules and settings are reused for up to 24 hours. Recorded batches waiting to be sent are dropped after a day. The rest stays until your code or the visitor clears it; see [Clearing it](https://geoengage.app/docs/widget/storage#clearing-it). |

## Consent

With [consent mode](https://geoengage.app/docs/widget/consent) on, nothing is recorded for analytics, and no recording starts, until the visitor accepts. The widget still looks up the visitor's country and loads your rules, because it needs both to show the banner in the right wording. If the visitor later withdraws consent, recording stops at once and any recording still waiting on their device is deleted.

Whether you need consent depends on your visitors and where they are. GeoEngage gives you the tools; it doesn't decide that for you.

---

Source: https://geoengage.app/docs/data-and-privacy