Privacy & Consent
Gate the Grovs Web SDK on user consent, and see what it collects
Gating collection on consent
Tracking is on by default. To gate it behind a cookie banner, configure with requireConsent: true, then grant consent once the banner is accepted:
await Grovs.configure({ apiKey: "your-api-key", requireConsent: true });
// Nothing has been stored on the device or sent. Events tracked meanwhile are
// held in memory and delivered once consent arrives.
await Grovs.grantConsent();configure resolves false while consent is pending. grantConsent() moves anything tracked meanwhile into durable storage, authenticates, and resolves true on success. A link token in the URL is captured in memory as soon as configure runs, so a router that cleans the query string while the banner is up does not lose the deep link.
Withdrawing consent
Grovs.reset();reset() clears every stored identifier, the session, and the queued events across all projects on the origin, and stops tracking. It does not re-authenticate on its own, which is the point: the visitor has withdrawn permission. To start again, call configure (then grantConsent() if you require consent). A reset in one tab stops the other tabs sending as the erased visitor.
Disabling the SDK
Grovs.setEnabled(false);Disabling stops the SDK rather than muting it: timers are cleared, lifecycle listeners are detached, the History patch used for screen tracking is removed (or left inert if another library has wrapped it since), and the messages UI closes and will not open. Screen alias updates are held. setEnabled(true) starts it again, and re-runs an initialization that was interrupted mid-retry.
What the SDK collects
| Data | When | Why |
|---|---|---|
User agent, screen size, time zone, language, WebGL vendor and renderer strings, your appVersion, the SDK version, and a session id | When configure authenticates | A device fingerprint used to match deferred deep links |
A visitor identifier stored in a cookie and in localStorage | Same | Recognizing the visitor across visits |
| User identifier and attributes | Only if you set them | Showing users in the dashboard |
| Installs, reinstalls, opens, time spent, reactivations | Automatically | Attribution and analytics |
| Custom events and screen views, with your properties and tags, a session id, and the attribution path the visit arrived on | When you call track / trackScreenView, and through automatic screen tracking | Analytics |
| Purchases | When you call logCustomPurchase | Revenue analytics |
With the default requireConsent: false this happens as soon as you call configure. With requireConsent: true nothing is written to the device and no request leaves until grantConsent().
The web SDK never reads the clipboard. Stored state is keyed per project and per testEnvironment; the visitor identifier is shared across projects on the origin.
Safari
The visitor identifier is written to both a cookie and localStorage, because Safari's Intelligent Tracking Prevention clamps script-written cookies to seven days regardless of the expiry requested. That covers visitors returning within the window, but ITP can still evict script-writable storage for genuinely dormant ones, so Safari install counts carry a small known over-count.
Logs
Set the level with debugLevel in configure. The default is "error", and an unrecognized debugLevel falls back to it. Grovs.setDebugLevel("info") changes the level of the configured client at any time; a value set before configure does not carry into it, and an unrecognized value silences every log line, so pass only "info", "warn", or "error". Warnings, such as a rejected event name or an ignored alias pattern, are only printed at "warn" or "info".