Tag Security & Data Disclosure

1. What the Tag Collects

The ClickLens tag collects the minimum set of signals needed to distinguish real humans from bots and automated click fraud. Everything collected is for fraud detection. Nothing is used for advertising, profiling or cross-site tracking.

Browser & Device Signals

• User agent string, browser language, and platform
• Screen resolution, colour depth, and device pixel ratio
• Hardware concurrency and device memory
• Timezone and timezone offset
• Connection type, network round-trip time, and downlink speed
• Font enumeration count (count only, not font names)
• Speech synthesis voice count (count only, not voice names)
• JavaScript engine detection
• Navigation performance timing (DNS and connection latency)
• WebGL maximum texture size

Fingerprint Hashes

• Canvas fingerprint — a hash (not the raw image) of how the browser renders a hidden canvas element
• Canvas stability verification — whether re-rendering produces an identical hash
• WebGL renderer and vendor strings
• Audio context fingerprint hash

These hashes are used to detect repeat visitors within a session window. They cannot be reversed to identify an individual. We do not store the raw rendered data — only the one-way hash.

Behavioural Signals

• Mouse movement patterns
• Click positions and count
• Scroll depth (how far down the page the visitor scrolled)
• Keystroke count and timing patterns
• Paste event count
• Time on page and page visibility changes

Keystroke content is never captured. We measure typing patterns to distinguish human input from automated input — we do not record which keys were pressed or any text that was typed.

Raw coordinates are never stored. Mouse positions, click coordinates, and scroll positions are processed in real time to compute statistical summaries (means, standard deviations, entropy). Only these aggregated metrics are persisted — the raw coordinate arrays are discarded after processing and cannot be reconstructed.

Automation Markers

The tag checks for headless and webdriver markers, the artifacts Puppeteer, Playwright and Selenium leave behind, and a navigator surface that contradicts itself. A real browser carries none of these, so the checks cost a genuine visitor nothing.

Navigation Context

• Landing page URL and referrer
• UTM parameters (source, medium, campaign, content, term) and ad platform click identifiers (Google gclid, Facebook fbclid, Microsoft msclkid, TikTok ttclid)
• Navigation type (direct, reload, back-forward)

2. Server-Side Enrichment

When the tag sends its data to our servers, we enrich it with server-side signals that the tag itself does not collect:

• IP address — extracted from the request, not collected by client-side JavaScript
• Geolocation — approximate location (country, region, city) derived from the IP address
• Network type — whether the IP belongs to a residential ISP, data centre, VPN, or proxy
• Network operator — the organisation that owns the IP range
• Threat intelligence — abuse confidence scoring from threat intelligence services (AbuseIPDB) to identify known-malicious IPs
• TLS fingerprint (JA4) — when provided by the reverse proxy (e.g. Cloudflare), the TLS handshake fingerprint is used to detect browser/TLS mismatches indicative of automation
• HTTP header analysis — presence of Accept-Language and Accept-Encoding headers (values are not stored)

IP addresses are stored to enable IP-based exclusion lists. They are not shared with third parties except where you explicitly connect a Google Ads account for automated exclusion syncing.

3. What the Tag Does NOT Collect

The ClickLens tag does not:

• Set cookies. Session identity uses temporary browser storage that is automatically cleared when the tab closes. No persistent identifiers are left behind.
• Track across sites. There is no cross-origin communication, no third-party cookie, and no shared identifier between different websites using ClickLens.
• Capture personal information. No names, email addresses, phone numbers, or any other PII.
• Read form inputs. The tag has no access to what visitors type into forms, search boxes, or any input fields. It measures typing patterns without reading any content.
• Access persistent storage. No cookies, no localStorage, no IndexedDB. Only ephemeral session-scoped storage is used.
• Make third-party requests. The tag communicates only with your ClickLens endpoint. It does not load external scripts, pixels, or resources from any other domain.
• Capture page content. No DOM scraping, no screenshot capture, no reading of page text or images.
• Record browsing history. Only the landing page URL and referrer are captured — no navigation beyond that.

4. Verifying the Tag

The ClickLens snippet carries no Subresource Integrity hash, and we ask you not to add one. SRI pins a script to one exact build. Click fraud moves, so the tag changes whenever detection improves, and every change moves its bytes. A browser holding a hash from an earlier build refuses to run the new one: no error you would see, no beacons, and a dashboard that goes to zero until someone notices and repastes the snippet. For a product whose job is to keep watching, that failure is worse than what SRI protects against.

You do give something up. With SRI, a new tag version cannot run on your site until you approve it by pasting the new hash. Without it, we update the tag and your site picks it up on the next page load.

What protects the tag instead

• Our own origin, over TLS 1.3. The tag is served from app.clicklens.io, the same host your beacons already post to. There is no third-party CDN in the path to compromise.
• A reproducible build. The tag is built from a pinned toolchain and a fixed obfuscator seed, so the same source produces the same bytes every time. Two builds that disagree fail our release check.
• A published hash you can check on demand. GET https://app.clicklens.io/api/v1/tag/integrity returns the SHA-384 of the tag we are serving right now. Compare it against the file your visitors receive whenever you want assurance, without pinning your site to it.
• Nothing the tag reads is secret. Your site key is public by design and grants no dashboard access. The per-site beacon token signs beacons; it cannot read your data.

<script defer
  src="https://app.clicklens.io/t.js"
  data-site="YOUR_SITE_KEY"
  data-cl-token="YOUR_TOKEN"></script>

If an older snippet on your site still carries an integrity attribute, delete it. Until you do, the browser console reports a Subresource Integrity error and the tag records nothing.

5. Security

Transport

• All data is transmitted over HTTPS (TLS 1.3)
• The API and tag are served from the same origin — no third-party domains involved

Data at Rest

• Database encryption at rest
• Fingerprint data is stored as irreversible hashes, never raw browser output
• Per-account data isolation — session data is accessible only to the account that owns the site

Abuse Prevention

• The beacon endpoint accepts at most 100 requests per IP address per minute
• Every beacon gets the same empty 204 response, whether it scored human, scored bot or failed signature verification, so a probe learns nothing from the reply

The Tag Itself

• Self-contained with no external dependencies
• About 34 KB minified (~13 KB gzipped) — small enough to read and audit manually
• Built reproducibly, with its SHA-384 published at /api/v1/tag/integrity so you can check the bytes your visitors receive

6. Performance Impact

• Script size: About 34 KB minified (~13 KB gzipped). The tag loads asynchronously and never blocks page rendering.
• Network requests: At most two small requests per page view — one shortly after the page loads, and one when the visitor leaves. Neither blocks navigation.
• CPU usage: Behavioural tracking uses passive event listeners, so it never delays a scroll or a click.
• No layout shifts: The tag is invisible. It creates no DOM elements, injects no styles, and has no visual footprint.

7. Compliance & Legal Basis

GDPR

ClickLens relies on the legitimate interest basis (Article 6(1)(f) of the GDPR) for fraud prevention and security. Some of what ClickLens processes — IP addresses and device-level signals — can be personal data under GDPR, so the legitimate-interest basis depends on a balancing test against each visitor's rights. Preventing ad fraud and protecting advertising spend is the interest we rely on; you remain responsible for confirming that basis holds for your audience.

As a ClickLens customer, you are the data controller for visitor data collected on your websites. ClickLens acts as a data processor on your behalf. We recommend disclosing the use of ClickLens in your website's privacy policy.

ePrivacy / Cookie Directive

The ClickLens tag does not set cookies or write to persistent storage. It uses ephemeral session-scoped storage that clears when the browsing session ends. Storage used solely for fraud detection is often treated as exempt from consent under the ePrivacy Directive, but device-level signals can still fall under PECR and similar rules. Disclose the ClickLens tag in your privacy policy and check whether your jurisdiction requires consent.

CCPA

ClickLens does not sell visitor data and does not build cross-site or advertising profiles. Signals are scoped per domain and per session. IP addresses and device fingerprints can be personal information under the CCPA; ClickLens uses them only for fraud detection, and you remain responsible for your own CCPA disclosures and obligations.

8. Data Retention & Deletion

• Session data retention is set by your plan: 7 days (Free), 30 days (Starter), 90 days (Growth), or 1 year (Pro)
• Your retention window follows your current plan. Upgrading or downgrading changes it, and a lapsed or cancelled paid plan reverts to the Free window (7 days)
• When you delete a site, all associated session data is permanently removed
• Account deletion removes all sites, sessions, and personal data within 30 days

9. Open Verification

We believe you should be able to verify our claims rather than take them on trust:

• Inspect the source: The tag is about 34 KB of minified JavaScript (~13 KB gzipped over the wire). You can download it, run it through a beautifier, and read every line. There are no obfuscated payloads or hidden network calls.
• Monitor network traffic: Use your browser's DevTools Network tab to see exactly what the tag sends. You will see one or two small POST requests to your ClickLens origin — nothing else.
• Check the hash: GET /api/v1/tag/integrity returns the SHA-384 of the tag we are serving. Hash the file you downloaded and compare, and you know your visitors are getting the script you read.
• Content Security Policy: If your site uses a CSP, you only need to allow your ClickLens origin for script loading and network requests. No other domains are required. See the installation guide for the exact directives and hash values.

10. Questions & Security Reporting

If you have questions about our data practices or security measures, contact us at security@clicklens.io or visit our contact page .

If you discover a security vulnerability in the ClickLens tag or service, please report it to security@clicklens.io . You will hear back within 48 hours.