More in Privacy and security
- Cookieless analytics and consent
- The compliance center explained
- Export your data and handle deletion requests
- How does TapCub count visitors without cookies?
- What are the three collection tiers?
- Do I need a consent banner?
- Does TapCub honor Do Not Track and Global Privacy Control?
- What does the compliance center control?
- How do I set privacy rules per region?
- What does China mode do?
- How do IP truncation and data retention work?
- How do I export my raw data?
- How do I handle a data-subject (DSAR) request?
- How do I delete a site or my whole account?
- All guides in this category
Still have a question?
Could not find it? A person reads every message, usually within a few hours on business days.
Chat with usShort answer
TapCub truncates IPs, replaces strings that look like emails or phone numbers, drops page query strings and skips element text by default. Keep personal data out of your own event properties, and mark sensitive properties as direct identifiers in the property dictionary so they are masked.
This page explains product settings. It is not legal advice; check what your own obligations are with your privacy or legal team.
What TapCub already does
| Data | Default handling |
|---|---|
| IP address | Truncated (2 bytes by default) before the location lookup, used for the visitor hash, then discarded. It is not written on events |
| Emails and phone numbers | Strings that look like an email address or phone number are replaced with a placeholder |
| Page address | The query string is dropped when a page is counted |
| Autocapture | Element text is not captured by default |
| Login | Email and phone passed at login stay out of the user profile by default |
These are set in ConfigurationPrivacy center, which the owner or an admin can edit. Keep stripping on unless you have a clear reason.
Where personal data still leaks in
- Event properties you send yourself, such as
name,emailor a free-text comment on a form event. - User properties set with identify, such as a full name.
- Page titles that contain a customer name, such as order or account pages.
- Custom IDs that are really an email address used as a user ID.
Mark sensitive properties
Open All-platform analyticsDataProperty dictionary and set a sensitivity on each property:
| Sensitivity | Example | Effect |
|---|---|---|
| Direct identifier | email, phone, full name | Masked by default |
| Indirect | city, company size | Shown, review before export |
| Non-personal | plan, button label | Shown |
Add validation rules (a regular expression, a maximum length or a list of allowed values) so a property such as plan cannot quietly start receiving email addresses.
A short checklist
- Use an internal ID, not an email, as the user ID.
- Send categories, not free text:
reason: "price"instead of the comment itself. - Search your tracking plan for
email,name,phoneandaddressbefore each release. - Review new properties in the property dictionary each month.
Remove data already collected
For one person, handle a data subject request: access, erasure, restriction or portability. For retention and IP settings, see IP truncation and retention.
Did this answer your question?
We use your answers to fix and expand this page.
Couldn’t send. Please try again in a minute.
Thanks for the feedback. We’ll use it to improve this page.You’ve already sent feedback on this page. Thanks.