Privacy

Privacy protection is built into the core of Takt, not bolted on afterwards. No cookie, no persistent identifier, no personal data leaves the browser. Visitors have nothing to accept.

When an event is not sent

Before any send, Takt checks four conditions in this order. If any is true, the event is silently dropped:

With the npm SDK and framework wrappers, exclude adds another lever: any page or named event whose path starts with an excluded prefix (e.g. ['/app','/account'], segment-bounded so /app matches /app and /app/… but not /application) is never tracked. It’s checked at send time, so it holds across SPA navigation. The minimal CDN snippet omits this option.

Giving control to the visitor

You can expose a “Don’t track me” button that drives the opt-out. The choice is written to localStorage (key takt_ignore), so it persists across visits on this browser.

In an npm integration, use the dedicated functions:

import { optOut, optIn } from '@vskstudio/takt-core'

optOut() // sets takt_ignore='1' — no event is sent anymore
optIn()  // removes the flag — resumes tracking

On the snippet (CDN) side, the global window.takt only exposes track. So drive the opt-out directly via localStorage — the snippet reads this key before each send:

function toggleTracking() {
  if (localStorage.getItem('takt_ignore') === '1') {
    localStorage.removeItem('takt_ignore') // opt-in
  } else {
    localStorage.setItem('takt_ignore', '1') // opt-out
  }
}

URL scrubbing

By default, Takt strips the query string and hash from every URL before sending — the page URL, the referrer and outbound link destinations keep only origin + path. A token, email or identifier slipped into ?... or #... therefore never reaches analytics.

You can tune this: trackQuery keeps the whole query, queryParams keeps only an allowlist, and scrubUrl replaces the logic with your own function (npm). On the snippet, use data-track-query or data-query-params for the same effect.

Deleting your account (GDPR)

You can delete your account yourself, without contacting support. This is your right to erasure (GDPR, Article 17).

Where: Settings → Profile tab → danger zone → “Delete my account” button.

The flow

1. The button opens a confirmation dialog.
2. Takt sends you an email containing a secure link. No password is required: confirmation happens through that link only.
3. You confirm by clicking the emailed link. The account is then deactivated immediately.

90-day grace period

Deactivation is reversible for 90 days. During this window the account is not erased: simply logging back in reactivates it — along with the organizations where you are the only member.

After that period, deletion becomes permanent and irreversible: account, personal data, avatar and the audience statistics of your solo organizations’ sites are purged with no way back.

Blocked case: sole owner of a multi-member organization

If you are the sole owner of an organization that has other members, deletion is blocked. You must first transfer ownership of that organization to another member (from the Team section) before you can delete your account.

Organizations where you are the only member are deleted together with your account.

What Takt does not collect

• No cookie and no session-identifier storage.
• No IP address kept on the client, no browser fingerprinting.
• No query string or hash in URLs (stripped by default).
• No personal data: keep your props anonymous and low-cardinality.