Cookies, Data Stored and Data Retention

Revenue First Analytics stores all analytics data in your own WordPress database and never stores visitor IP addresses. It sets at most two first-party cookies, _rfa_vid and _rfa_consent, and only after consent or in Full tracking. Raw visit data is deleted after 365 days by default, while revenue rows are kept with the buyer’s name and email hash removed.

This page is a reference you can use when writing your privacy policy. What is stored depends on the tracking mode you pick in Settings: Privacy mode (cookieless, no personal data), Consent mode (cookieless until the visitor accepts statistics cookies) or Full tracking (a cookie for every visitor). See Choosing a Privacy Mode for help deciding.

Which cookies does the plugin set?

Both cookies are first-party, set with path=/, SameSite=Lax, a one-year max-age, and the Secure flag on HTTPS sites. The plugin uses no third-party cookies and no local storage.

When you switch to Privacy mode, the tracker removes both cookies from the visitor’s browser on their next pageview. If a visitor withdraws consent, _rfa_vid is removed the same way. See Connecting Your Cookie Banner for the consent flow.

What is stored for each visit?

A pageview is one page load; a session is a visitor’s activity with gaps of less than 30 minutes. For every pageview and session the plugin stores the following in its own tables in your WordPress database.

Events (add to cart, begin checkout, purchase, goals and custom events) are stored with their name, the page path, the timestamp and a small data payload: product ID, name, quantity and price for add to cart; cart total and item count for begin checkout; order ID, platform, total, currency, product names and item count for a purchase; and whatever you pass to window.rfa() for custom events.

What is stored for orders and form submissions?

The email on orders is hashed with WordPress’s wp_hash() before it is written, so the plaintext address is never in the analytics tables. The same hash is used to look the buyer up later. See Handling GDPR Access and Erasure Requests.

What is never stored?

• IP addresses. The IP is used in memory to compute the daily hash and look up the country, then discarded.
• Fingerprints. No canvas, font or hardware fingerprinting. Device, browser and OS come from the User-Agent header only.
• Form content. Messages, phone numbers, uploads and every other submitted field are never stored, in any mode.
• Billing address and phone. They are read from the order only to send hashed matching data to Facebook when that integration is on, and are not written to the analytics tables.
• Query strings of visited pages and referring URLs.

How does the daily rotating hash work?

Anonymous visitors get a server-side visitor ID built from a hash that uses a new random salt every UTC day, and old salts are deleted, so an old ID can never be linked back to a person. The practical consequence: a returning anonymous visitor counts as a new visitor each day, and an order is attributed only when it happens on the same day as the visit. The full mechanism is explained in Choosing a Privacy Mode.

How long is data kept?

The Data retention (days) setting in the Data Management card of Settings controls this. The default is 365 days. Set it to 0 to disable the cleanup. See Revenue First Analytics Settings Explained for the other options in that card.

A WP-Cron job runs once a day (scheduled for 03:00 UTC) and applies the setting:

• Deleted: pageviews, sessions and events older than the retention period, in batches of 5,000 rows to avoid locking the database.
• Kept and anonymized: revenue rows older than the retention period. The amount, currency, products and attribution (channel, referrer, landing page) stay so revenue reports remain complete, but the buyer’s name and email hash are blanked.
• Untouched: goals and funnels.

Deleting the plugin does not remove its tables unless you turn on Delete all data on uninstall in the same card. With that toggle on, deleting the plugin from the Plugins screen drops every analytics table, which cannot be undone.

What should your privacy policy say?

The plugin adds a suggested text to WordPress’s privacy policy guide. Open Settings > Privacy in wp-admin (the WordPress Settings menu, not the Rev Analytics settings), switch to the Policy Guide tab and look for the Revenue First Analytics section. The suggested text covers four points:

• You use Revenue First Analytics to measure visits and which pages and campaigns lead to purchases and enquiries; all data is stored on your own server and not shared with third parties.
• Without consent you store no cookies or identifiers; visits are counted with a daily changing hash of the IP address and browser, and the IP itself is not stored.
• If the visitor accepts analytics cookies, you set _rfa_vid (1 year) and link purchases and form submissions (name and email) to the visit that brought them; _rfa_consent (1 year) stores their choice.
• If the visitor accepts marketing cookies and you have enabled it, purchase and cart events are also sent to Meta through the Conversions API, with email, phone and address hashed.

Remove the points that do not apply to your mode. In Privacy mode only the first two apply. This is not legal advice; check the final text with your own advisor.

Which third-party services receive data?

None by default. Data leaves your server only when you enable one of these integrations.