Websites & tracking
Pixel security & privacy review
For a security or privacy review: the domains the pixel uses, Content Security Policy rules, what it sends and stores, and the controls you have.
For the developer or security reviewer installing the tracking pixel.
Domains it uses
| Domain | What for |
|---|---|
rest.happierleads.com | Serves the pixel script (the one line you install). |
page-visits-full.happierleads.com | The page-view beacon. This is how visitors are identified, so it is required. |
tracking.happierleads.com | An email the pixel found (see below) and custom events you send. |
session-recordings.happierleads.com | One small settings check per visit; page snapshots only if Session Recordings is on. |
cdn.jsdelivr.net | Only with Session Recordings on (the open-source rrweb recorder). Never requested otherwise. |
Content Security Policy
With Session Recordings off:
script-src 'self' https://rest.happierleads.com;
connect-src 'self' https://page-visits-full.happierleads.com https://tracking.happierleads.com https://session-recordings.happierleads.com;With Session Recordings on, script-src also needs https://cdn.jsdelivr.net and 'unsafe-eval'.
What it sends and stores
- Page views: your site ID, the page URL, UTM parameters, the referrer and any custom data you set. Like any request, it carries the visitor's IP address and browser. Known bots and headless browsers send nothing.
- Browser storage: no cookies by default. It keeps housekeeping values so it doesn't send the same thing twice:
localStoragehl_lead_id,hl_full_mode_pages,hl_last_tracking_time,hl_basic_tracking_sent,hl_last_sent_email,changed_email_b,activeTabId,lastTimeSentToServer;sessionStoragehl_rec_cfg,hl_pcap_*. Only when ad engagement tracking for Optimize is on does it also set a first-partyhl_adcookie. - Privacy rules treat browser storage like cookies, so load the pixel through your consent manager.
Controls
- Email capture is on by default: the pixel recognises an email the visitor already gave you (your forms, autofill, the page URL, your storage), so you don't spend a credit identifying someone you already know. Identification works without it. We switch it off per website or account on request: ask us in the chat.
- Session recordings are the only feature that takes page snapshots. Switch them off under Website Settings → Visitor Tracking.
- Withdrawn consent: the pixel stops loading on later pages. To clear what it stored, remove the keys above and reload.
Browser pixel only
Identification needs the visitor's own browser to contact us; a request forwarded from your server carries your server's details instead, so server-to-server is not supported.