What snorklee collects

snorklee collects only the bare minimum needed to give you useful statistics. The goal is to measure a site, never to recognise a person.

#What the code sends from the page

From your pages, the small piece of code that snorklee installs may send: your site's identifier, the page being viewed, the site the visitor came from, how far down the page they scrolled, the time spent, the type and name of the event, a few limited properties, and the address of any link they click to leave your site.

A pageview is sent for each page viewed: when a page loads, and also on every path change in a single-page site (Next.js, Nuxt, React Router…, through the browser's History API) — the page being left is then sent with its duration and scroll depth. Of the page address, only the path is sent: never the parameters after "?", never the fragment after "#".

The campaign tags in your links (utm_source, utm_medium, utm_campaign, etc.) are not collected: they are stripped out on arrival and never stored.

The code never reads what your visitors type into forms.

#Actions measured automatically

Without a single line of code on your side, the script records the fact that a visitor submitted a form, clicked an e-mail (mailto:) or phone (tel:) link, or opened a file to download. Only the fact is sent, along with the page it happened on: never the e-mail address, never the number, never the file name, never the content of a field.

#What our server uses in passing

On arrival, our server may briefly use the IP address, the User-Agent (the browser's technical "ID card") and the browser language to work out the country, recognise the browser and device, block abuse, link together the pages of a single visit for a short while, and set aside a hit claiming to be OpenAI, Anthropic or Perplexity from an address outside the ranges they publish (a useful check, not proof of identity). The raw IP address and User-Agent are not kept in your statistics.

#What is actually kept

In your statistics we keep, for example: the date, the page viewed, the site of origin and the outbound link, the source, the country and region (worked out from the IP address — never the city), the browser family, the system, the device, the language, the type of event, the time spent, the scroll, the bounce, and the already-cleaned properties.

AI-bot visits also carry the name of the bot family, what it came to do, its user-agent marker and the result of comparing its address with the ranges its vendor publishes — a technical indication, not proof of identity. These are not visitor data: a bot is not a person.

#Never send us

Never slip an email, phone number, name, address, customer number, CRM identifier, advertising ID, IBAN, bank card, health data or password into events, properties or URLs.