Site Tracking

What Site Tracking sends and stores

Exactly what your server sends to Ranqo for each page view, what Ranqo stores, how visitor IP addresses are handled, and what is never collected.

Site Tracking runs on your server, not in your visitors' browsers, so you decide exactly what leaves your site. This page lists every value that is sent, what Ranqo keeps from it, and what happens to IP addresses.

What your server sends

For each page view it reports, the install code sends six values in one GET request, and nothing else about the visit:

Value	What it is
`url`	The full address of the page requested, including any query string.
`userAgent`	The `User-Agent` header of the request.
`ref`	The `Referer` header: the page the visitor came from, if their browser sent one.
`ip`	The visitor's IP address.
`country`	The visitor's two-letter country code, when your host or CDN gives one. See below.
`websiteKey`	Your site key, which tells Ranqo which brand the visit belongs to.

No cookies, request bodies, form data or other headers are sent. The report travels from your server to Ranqo, so the visitor's browser never contacts Ranqo. There is no script on your pages and Site Tracking sets no cookie, so nothing is stored on your visitors' devices.

What Ranqo stores for each visit

Stored	Detail
Page	The full URL as sent, plus its host and path.
User agent	The user agent as sent.
Classification	The bot's name, operator and type, or that the visit was a person; and the AI assistant that referred it, if any.
Referrer	The referrer as sent, and its host.
IP address	A hash, not the address. See below.
Country	The visitor's two-letter country code as your install sent it, or none. See below.
Verification	Whether the address matched the bot operator's published ranges.
Time	When Ranqo recorded the visit.

Visits belong to the brand the key belongs to.

How IP addresses are handled

Ranqo uses the visitor's IP address for two things, and the visit record keeps a hash in its place:

Verification. For a request whose user agent claims to be a known crawler, Ranqo checks the address against the IP ranges that crawler's operator publishes, where Ranqo reads that list, and stores the result.
A hash. Ranqo stores a SHA-256 hash of the address combined with your brand's identifier. The same address produces the same hash within your brand, which is how unique and returning visitors are counted, and a different hash in every other brand.

The hash is pseudonymous, not anonymous. Anyone holding it and your brand's identifier could recover an IPv4 address by hashing every possible address until one matches.

A raw address is also held in these places:

The site key's record. It keeps the IP address and user agent of the most recent recorded visit, replaced by each new one. The dashboard's site key and traffic data requests return the address to people signed in to your account, though no page displays it.
Processing. The report, raw address included, passes through Ranqo's processing queue before it is stored as a visit.
Request logs. The address, like your site key, travels in the query string of each report, so it can appear in the request logs of Ranqo's hosting provider.

If you would rather not send addresses at all, send ip empty. Visits are still recorded and classified, but no bot visit can then be verified, and every visit carries the same hash, so unique and returning visitor counts treat them all as one visitor.

Where the country comes from

The country is the one your install code sends, read from the visitor's request on your side. Ranqo does not derive it from the IP address.

Next.js, Express and Python: on Vercel, the code sends the country in Vercel's x-vercel-ip-country header. Elsewhere it sends none until you set COUNTRY_HEADER at the top of the install code to the header your CDN writes: cf-ipcountry behind Cloudflare, or cloudfront-viewer-country behind Amazon CloudFront when your origin request policy includes it.
Cloudflare Worker: the code sends the country Cloudflare gives the request, request.cf.country.
Your own code: send the country your host or CDN gives you, or nothing.

A report without a country, or with a value that is not a two-letter code, is recorded without one. Cloudflare's codes for an unknown location (XX) and for Tor (T1) count as none. A visitor can send any header themselves, so the install code reads only the one your platform writes. Name a CDN's header only if every request reaches your server through that CDN: a request that goes around it can carry any country.

The country shows in the Live Feed, in the install page's confirmation and on the Countries card of a channel's detail on the Traffic page, which counts only the visits that carry one.

What you control

Query strings. The install code sends the full URL. If your URLs can carry personal data in the query string, such as an email address in a sign-up link, send the URL without its query string. Ranqo needs the host and path, and reads one value from the query string: the campaign tag utm_source, which names the AI assistant when a visitor arrives without a referrer. To keep that, remove every parameter except utm_source; without it, those visits count as Direct.
Which hosts are reported. Add hosts you do not want tracked, such as your signed-in product, to SKIP_HOSTS in the install code.
Which pages are reported. The install code is yours to change. Anything it does not send, Ranqo never sees.

How long visits are kept

Recorded visits stay with the brand. The Traffic page shows as far back as your plan's history window; see Plans and limits. To have a brand's recorded visits deleted, contact us.

Intake API

Every parameter the endpoint accepts.

Site Tracking

How visits are classified.