URLs, requests and cookies
Ta treść nie jest jeszcze dostępna w Twoim języku.
Every URL is cleaned in the browser before it is sent:
- Only the query parameters in Analytics settings → Kept URL parameters stay (by default
utm_*). - Ad-click identifiers (
gclid,gbraid,wbraid,msclkid,fbclid) are always removed. A session records only which one its landing page carried, by name. - Emails and phone numbers in the path are masked.
So https://example.com/search?q=rtx&utm_source=google&[email protected] is stored as https://example.com/search?utm_source=google.
Search terms are still recorded, masked. If you use other campaign parameters, such as ref or aff_id, add them to the list.
Network requests
Section titled “Network requests”The script watches fetch and XMLHttpRequest calls:
| Request | Recorded? |
|---|---|
| Failed, or status 400 and above, on any host | Yes, as a network error |
| Successful, to your shop’s own host or its subdomains | Yes, as a network request, for timing |
| Successful, to any other host (analytics, ads, payment widgets…) | No |
On www.example.com, requests to example.com, www.example.com and api.example.com are kept; requests to google-analytics.com are not. Only the method, host, path (masked), status and duration are kept. Never the query string, bodies or headers.
Cookies and storage
Section titled “Cookies and storage”With consent (or consent set to Not required), the script stores:
| Name | Kind | Contents | Lifetime |
|---|---|---|---|
_qm_sid |
First-party cookie | Session id (a random UUID) | 30 minutes, rolling, at most 24 hours |
_qm_vid |
First-party cookie | Visitor id (a random UUID) | 13 months |
Both cookies are SameSite=Lax. Set cookieDomain in init to share them across subdomains. Your server can save them on orders.
localStorage and sessionStorage hold cached site settings, the traffic source and a replay counter.
Without consent, nothing is written. Withdrawing consent deletes the _qm_* cookies.
Where data goes
Section titled “Where data goes”The script sends data only to ingest-prod.quomerce.com and loads no third-party code. See the Quomerce privacy policy.