Consent, privacy & CSP

Consent

Tracking follows Shopify’s Customer Privacy API — the choices visitors make on your store:

• Without marketing consent nothing is sent to any ad platform. The event is still stored, and the order shows No consent;
• GA4 follows analytics consent and carries the Consent Mode choices with each event;
• Global Privacy Control (the browser’s Sec-GPC) and US “do not sell” turn on Meta’s Limited Data Use and switch off ad personalization;
• The checkout pixel must be set to require Marketing under Customer privacy in Shopify admin; Shopify won’t load it for visitors who haven’t consented.

What Hydrogen does

Hydrogen publishes storefront events only once a visitor allows analytics. In regions that require consent, visitors who decline generate no storefront events in the first place.

Personal data

• Email addresses, phone numbers, names and addresses from checkout are hashed the moment they reach Gosper, following each platform’s normalization rules. Plain text is never stored.
• Browser-side advanced matching for Meta is hashed by Meta’s own SDK.
• What is stored are the platforms’ cookie identifiers and click ids (_fbp, fbclid, gclid, ttclid and friends), used for matching and attribution.
• Logs record event type, status and timing — never message content or personal data in the clear.

Domains to allow

With browser pixels on, your storefront’s policy must allow the domains of the platforms you enabled. The management page lists exactly those; add them to defaultSrc and connectSrc. With browser pixels off, nothing changes.

Run npx gosper-tracking check https://your-store.example to see whether the live policy is missing any.

First-party cookies

The storefront’s identifiers, such as _gosper_vid, are written on your own domain as first-party cookies and refreshed on each request, so Safari’s third-party cookie limits don’t apply. Cart attributes carry those identifiers into checkout, so they still line up when checkout finishes in another browser (after an external payment redirect, for example).

Data retention

• Raw deliveries: 90 days;
• events, touches and orders: 400 days;
• cart snapshots: 30 days.

Deleting a store deletes its data with it.

What to tell your visitors

Gosper sends data to the ad platforms you configure on your behalf; you remain the data controller. Make sure your privacy policy and consent banner cover those platforms and any browser pixels you enable.