Cookieless is a design. Consent is a legal question.
What we can tell you precisely, and where we stop.
What we can state as fact
These are properties of the implementation, not claims about your obligations:
- Nothing is stored on or read from the visitor’s device.
- IP addresses and user agents are never written down — they are hashed at ingest and discarded.
- After 48 hours the salt is deleted and the hashes cannot be recomputed.
- Once a day’s salt is deleted there is no durable identifier left to join the data to a profile, or across sites.
- Raw events are purged after 180 days by default; reporting runs on daily aggregates.
What you still have to decide
Whether any of it needs consent. That turns on your jurisdictions and on what you choose to collect on top of the defaults — a custom event prop is a field you control, and you can put something personal in one. We cannot know those things, and a page like this should not pretend to.
FunnelSights makes no claim that using it removes a consent requirement, and will not make one. A cookieless design does not by itself establish a consent exemption or any compliance status — that is a conclusion about your specific use, reached by someone qualified to reach it. What we owe you is an exact description of what the software does, and the list above is it.
What we publish
The sub-processor register, in full: every third party that can access data is named there, with what it can see and whether it is in the path today. Deletion is written down: ask in writing and your data is deleted within 30 days, and a written processing agreement is available where one is required.