Overview
Cookies are small files a website stores in your browser. Local storage is a similar browser feature that lets a website save data on your device. Both count as storing information on your device under laws such as the EU ePrivacy Directive and the UK PECR.
Everything Invoker stores is first-party. It belongs to the website you are visiting, or to that website's own analytics endpoint, and is never readable across unrelated websites.
On websites that use Invoker
When a website includes the Invoker script (https://cdn.invoker.app/script.js), the following may be stored in your browser. The website owner decides to use Invoker and is responsible for this storage.
| Name | Where | Set by | Purpose | Duration |
|---|---|---|---|---|
invoker_cid | localStorage | Invoker script | A random visitor ID, used to count unique visitors to this website. | Until cleared |
invoker_session | localStorage | Invoker script | A session ID and the time of last activity, used to group pageviews into visits. | Until cleared; a new session starts after 30 minutes of inactivity |
blockInvokerTracking | localStorage | Invoker script | Set only if you opt yourself out. Stops the script sending data from this browser. | Until cleared or you opt back in |
inv_visitor | Cookie (HttpOnly, SameSite=Lax) | Invoker API | A random visitor ID, set only when the request to the API is same-site. | 1 year |
inv_sid | Cookie (HttpOnly, SameSite=Lax) | Invoker API | A random session ID, set only when the request to the API is same-site. | About 35 minutes (30-minute session timeout plus 5 minutes) |
The inv_visitor and inv_sid cookies are never third-party cookies. Your browser only sends them when the analytics endpoint is on the same site as the page you are viewing.
The script also reads invoker_exclude_tracking (described under On invoker.app) so that Invoker customers' own visits are not counted.
When local storage is unavailable
If your browser blocks local storage, the script cannot keep a random ID. Instead it computes a short hash from browser characteristics (screen size and colour depth, time zone offset, language, number of processor cores and platform) and uses it as the visitor ID.
This hash is not stored on your device. It is shared by many browsers with the same setup, so it is approximate, and it is not used to follow you across websites.
On invoker.app
Our own website and dashboard use the following.
| Name | Where | Set by | Purpose | Duration |
|---|---|---|---|---|
invoker-auth | localStorage | Invoker dashboard | Keeps you signed in: your sign-in token and basic profile. | Until you log out |
theme | localStorage | Invoker dashboard | Remembers your light or dark mode preference. | Until cleared |
invoker_exclude_tracking | Cookie (on .invoker.app, SameSite=Lax) and localStorage | Invoker dashboard | Set when you log in, so the Invoker script does not count your own visits. Contains your user ID, a timestamp and the IDs of sites you can access. | Up to 1 year; removed when you log out |
| Cloudflare Turnstile | Cookies or storage set by Cloudflare | Cloudflare | Bot protection on the sign-up page. May set its own cookies or storage to tell humans from bots. | Set by Cloudflare |
| Stripe | Cookies set by Stripe | Stripe | Checkout and the billing portal are hosted by Stripe, which sets its own cookies for payments and fraud prevention. | Set by Stripe |
The dashboard's locations map loads map tiles from Mapbox, which receives your IP address and browser details when the tiles load.
If we use Invoker on invoker.app to measure our own site, the same first-party storage described above for websites that use Invoker applies.
What we don't do
- We do not use third-party advertising cookies.
- We do not track you across websites or build profiles of you.
- We do not sell or share data for advertising.
Consent
Invoker is designed to collect as little as possible, but it still stores information on your device. Depending on the jurisdiction, for example under ePrivacy or PECR rules, the website owner may need to ask for consent before the script runs. Each website owner is responsible for that decision and for any consent banner.
Website owners can also reduce what is collected:
- turn on Do Not Track support, so browsers sending the DNT signal are not tracked
- block specific IP addresses or countries
See our docs for setup details, and our Privacy Policy and Data Processing Agreement for how the data is handled.
How to opt out
- On a specific website. Open your browser's developer console on that site and run
window.invoker.blockTrackingForMe(). This savesblockInvokerTrackingin local storage and stops tracking from that browser on that site. Runwindow.invoker.enableTrackingForMe()to undo it. Some websites also offer their own opt-out link. - In your browser. Clearing cookies and site data (including local storage) removes the identifiers above. You can also block storage for a site, or use a content blocker.
- Do Not Track. If the website owner has enabled it, turning on Do Not Track in your browser stops tracking on that site.
Changes
We will update this page when the storage we use changes, and update the date at the top.
Contact
Questions about this policy: support@invoker.app. If you have questions about a website that uses Invoker, please contact that website's owner.