Privacy & Data Handling

The Hood Web SDK is built with privacy by design.

This page explains what data the SDK stores, how it behaves with or without consent, and what developers need to configure in their Consent Management Provider (CMP).

Our goal is to keep integration simple while remaining fully compliant with GDPR and other privacy standards — without unnecessary legal complexity.

Overview

All data is stored directly in the browser using:

• sessionStorage – temporary data automatically removed at the end of a browser session
• localStorage – persistent data such as consent preferences and technical keys that last between sessions

All SDK data is kept under a single storage key called _OPC.
This key contains a JSON object with all values used by the SDK.

Example structure:

{
  "_OPC": {
    "session_uid": "b4f2c1e2-91d3-4a7a-a2c1-f8a3c2d7c5",
    "userConsent": { "analytics": true }
  }
}

Storage Overview

Session Data (Without Consent)

When no consent is given, the SDK will:

• create a temporary session ID (random and non-persistent),
• store it as _OPC.session_uid inside sessionStorage,
• use it to group analytics events within the same browser session.

This ID is deleted automatically when the session ends.
It cannot identify a user and does not require consent.

Example session data:

{
  "_OPC": {
    "session_uid": "b4f2c1e2-91d3-4a7a-a2c1-f8a3c2d7c5"
  }
}

This allows the SDK to measure simple things like page views or event counts — fully anonymous.

Persistent Data (With Consent)

If the user gives consent via your CMP, the SDK can:

• keep the consent state,
• track campaign parameters (utm_*) and push permission data,
• associate events to a server-side profile when your app calls identify (optional).

Example flow:

Hood('consent', { analytics: true });
Hood('identify', 'user_12345');
Hood('trackEvent', 'purchase', { value: 25 });

If consent is later withdrawn, the SDK will stop using identifiable data and continue with anonymous session tracking only.

What Data Is Stored

All data is stored under the single key _OPC.

How the SDK Handles Consent

The SDK includes a simple consent interface that should be synced with your CMP.

Setting Consent

Pass consent states directly from your CMP:

Hood('consent', {
  analytics: true,
  marketing: true,
  push: false
});

Updating Consent

If the user updates consent:

Hood('consent', newConsentState);

Clearing Data

For “right to be forgotten” or user data removal:

Hood('identify', null);
Hood('consent', { analytics: false, marketing: false, push: false });

CMP Configuration Guide

In your Consent Management Provider (CMP), define the following categories and map them to the SDK purpose keys:

Best Practices

• Send consent to the SDK immediately after your CMP loads
• Linking events to a person happens server-side via identify and requires consent (no user IDs are stored locally)
• No data passed via identify() setUserProperties() is saved locally
• Use unique key names if your app also writes to localStorage
• Keep your SDK up to date — privacy rules evolve

Quick Reference

Summary

• All SDK data is stored under a single key _OPC in browser storage.
• Temporary analytics works anonymously during the session.
• Persistent data (like UTM parameters) is stored only with consent.
• Push keys (psh<hash>) are functional domain checks — never user identifiers.
• The SDK is designed to remain fully compliant and privacy-safe out of the box.

Need more technical details?
Check our Integration Guide or contact our support team.