legal / cookies

Cookies and storage.

The tracker writes nothing to a visitor's device. The panel uses cookies, because somebody signs into it. Those are different pieces of software and this page keeps them apart. Last updated 2026-09-19. Questions go to privacy@kehai.io.

Why this page exists separately

Two very different things get called cookies, and putting them in one paragraph is how a reader ends up misinformed.

The tracker on a customer's site writes nothing to a visitor's device. No cookie, no local storage, no session storage, no database in the browser. That is a technical fact and it is what makes the visitor measurement what it is.

The panel is a different piece of software and it does use cookies, because somebody signs into it. Mixing the two would let a true statement about one become a false statement about the other.

The tracker, on a customer's site

cookiesNone

local and session storageNone

persistent identifierNo visitor identifier is written to browser storage

what is readPage address, referrer origin, screen and window size, language

Every field that is stored

The list above is what the browser sends. This is what a row in the database actually holds, in full, because an inventory that leaves something out is the gap a reviewer finds first.

the pagePath and query string, minus the parameter names the site's owner blocked. No page title, ever.

where fromThe referrer's hostname only, never its full address. Unblocked click identifiers retain their supplied values under the query limits described below.

the hostWhich of the site’s own hostnames the page was on. A site may answer at several, and this is how they are told apart.

campaignThe five utm_ parameters the visit arrived with, kept in fields of their own as well as inside the address, and carried onto every page of that visit.

placeCountry, region, and city, from a file held on the server. Never a coordinate, and no lookup leaves the machine.

languageThe first language tag your browser offers, such as pl or en.

browser and systemName and major version of each, and a device class: desktop, mobile, or tablet.

sizeWindow width and height, screen width and height.

timeThe moment of the request, observed visible time, and a flag for an interval whose duration could not be established.

view measurementA measurement version, a view hash scoped to the site and UTC-day visitor, and an update sequence. The original random view code stays only in page memory during collection, is not written to browser storage, and is not retained by the collector.

loadingLargest contentful paint, interaction to next paint, and cumulative layout shift, only where the site's owner switched the performance module on. Nothing extra is added to the page for it: the measurements ride in the one script every site already carries, and the switch decides whether they are stored.

declared eventsThe event names and string properties the site's owner chose to send, plus outbound destination hosts and downloaded file paths where those are switched on.

ordersAmounts, currency, coupon code, item lines and supplied landing context from the shop's server, with an actual sale time when provided. Kehai adds a random conversion identifier for stable exports. Never the shop's order number, a customer id, or an email.

tracking linksA click on a campaign link the site's owner built: its referrer, country, device, and the same daily visitor identity.

automated trafficFor requests classified as bots only, up to 512 characters of the declared user agent and the matching rule, kept for the site's retention window. The string is supplied by the caller and can contain identifying information.

Two things this cannot promise. A page address a site's owner designed is theirs, so a route like /orders/12345 is stored as it arrives, and so is a query parameter they did not block; the site settings carry the editable list of parameter names to refuse and new sites start with names that usually carry credentials. This list can be changed or emptied. The installation tag loads one script, the same bytes for every site, and carries no per-site list; there are no additional fixed query-name exclusions. A list change takes effect on the next event that arrives. Intake also applies the current list before storage. Older tags retain their copied list until replaced with the short tag. Unblocked click and sharing parameters, including gclid and fbclid, retain their supplied values within the 2,048-character URL input and 255-character query key/value limits. They can link records beyond a daily visitor code and remain for the site's retention window. Older rows containing only a 1 marker stay unchanged; the discarded values cannot be reconstructed. Site owners also choose the event properties they send. Kehai checks declared event and property names and values for recognized identifying shapes. That value check does not apply to arbitrary URL paths or unblocked query values, and it cannot know what a customer's own addresses mean.

How one visitor is told from another without browser storage: the server derives a one-way visitor code from the site, the network address, and the browser's user agent together with a salt that is replaced every midnight UTC. A separate visit code groups activity until 30 minutes of inactivity or midnight UTC, whichever comes first. For new measurements, neither code nor the visit's attribution is carried into the next UTC day. The codes are stored with event details for the site's retention window; this is server storage, not browser storage. Older event rows and earlier exports and backups are not rewritten by this change.

Being precise about consent, rather than convenient

Kehai sets no analytics cookie and writes no visitor identifier to browser storage. That does not settle consent. The European Data Protection Board's final guidance on article 5(3) explains that JavaScript instructing a device to return information can fall within the rule without a cookie.

A consent exemption depends on the actual collection, its purpose, configuration, and applicable national law. The absence of cookies does not establish an exemption under Polish law or another jurisdiction. This statement supplies technical facts for that assessment. It is not a legal opinion approving a particular installation, including kehai.io.

The optional Kehai WordPress/WooCommerce plugin has a separate commerce function. It does not create an analytics cookie or browser-storage identifier, but it can use an already-existing WooCommerce session on the customer's shop to retain available acquisition context and attach it to an order. It does not start a shop session to recover an earlier ad visit. Session context older than two days is not attached to a new order; order context is eligible for at most 90 days and is removed by scheduled cleanup or order privacy/deletion hooks. WordPress cron delays can delay physical deletion. DNT/GPC suppresses this context and associated plugin commerce delivery. The customer must assess the existing shop session and this use of it as part of the installation; absence of a newly created cookie is not a consent exemption.

The PrestaShop module can use an existing cart for available acquisition context. It creates no cart or browser identifier for analytics. Its cart context expires after 30 minutes without activity or at midnight UTC; order context clears after 48 hours and suppression markers after 30 days, through scheduled cleanup. DNT/GPC suppresses the context and associated commerce delivery. Wix and Squarespace commerce connections run on the server; their API keys do not install browser code. The merchant's own platform may still use functional shop cookies.

The panel, at app.kehai.io

Signing in requires cookies. These are not analytics and none of them follows anybody anywhere.

sessionWho is signed in. Required, expires, and is cleared on sign out

remember meWhether the session should outlive the browser window

second factorSet while a code or passkey is being confirmed

trusted deviceSet only if a device is marked as trusted during that step

sidebar stateWhether the navigation is open or collapsed

The sign-in cookies are sent only over an encrypted connection and cannot be read by scripts on the page. They are set for the whole of kehai.io rather than for one address, because signing in happens on one host and the panel is on another, so a browser sends them to every Kehai hostname including the one that receives measurements. Nothing there reads them, and a narrower handoff that would not need them to travel is planned. Signing out clears the session cookies across that domain. An optional trusted-device marker can remain for later sign-ins until it expires or is invalidated.

Kept in the browser rather than in a cookie

themeLight or dark, in local storage

selected siteWhich site a report screen opens on

report layoutSmall preferences about how a screen was left

sign-up on kehai.ioThe plan you chose, the email, name, and company you typed, the domain, and the verification record you were asked to publish, in this tab's session storage from the moment the record is issued, so a reload returns you to the verify step and the page can name your address when you come back from Stripe. After a Checkout return, the same record also holds the Checkout session reference so a reload can resume pending account setup. That reference is removed when setup completes, Checkout is canceled, or the saved signup expires. It is not sent to analytics. The local copy is removed when the tab closes or account setup completes. Signup and verification requests separately send the details needed for those steps to Kehai. A signup may also transmit its current landing path, bounded query parameters and referrer hostname for subscription-source measurement. Server-side query exclusions follow the configured analytics site's settings. Since September 19, 2026, the address you arrived at and the hostname you came from are also kept in this tab's session storage under one entry, so a signup you start from another page of the site can still name the campaign that brought you. That entry holds no visitor identifier, is gone when the tab closes, is not sent to analytics, is suppressed by DNT/GPC, and is described in the Privacy Policy

sign-in on kehai.ioA timestamp in this tab's session storage, written when the sign-in screen sends an already signed-in browser on to the panel, so the two hosts cannot bounce you between them. Gone when the tab closes, and never sent anywhere

The chosen color palette is not in the browser at all. It is stored with the account, so the panel arrives already wearing it on the first render.

Set by somebody else

cf_clearanceCloudflare, only when a security challenge is presented

TurnstileOn the contact form and the newsletter form, to tell a person from a script. On the landing page it loads only once you reach for the field

Both are strictly necessary for the page to be served safely, build no profile, and are not used for analytics.

What is never set

The analytics tracker sets no advertising cookie, retargeting pixel, social platform tag or shared cross-site visitor identifier, and embeds no third-party analytics. It does not inspect canvas output, font inventories or installed plug-ins. The daily code derived on the server from the network address and user agent is described above.