IP addresses
Whence does not store the IP address of the visits it records. There is one exception, for sending sales to ad platforms, and it lasts 7 days. Here is every place an IP address comes into play.
Visits and recordings: never stored
- Country: Whence takes the visitor’s country from the two-letter code its network already attaches to each request, not from the IP address. Through the Shopify app, it uses the country Shopify determined for the visitor.
- Region and city: only if your store passes them to the tracker. Whence never calls an IP location service.
- Custom data: event properties with a name that looks like an IP address are dropped before they are saved.
Limiting abuse: a fingerprint that changes every day
To stop a single sender from flooding your store with fake visits, Whence counts requests per sender over one minute. It counts them by a scrambled fingerprint of the IP address that changes every day, not by the address, and the fingerprint is not attached to any visit.
Step 1: Blocked IP addresses
In Settings > Exclusions > Blocked IP addresses, you can block an office or a warehouse so its visits are not recorded. Whence keeps only a scrambled fingerprint, never the address itself, so the screen shows how many addresses are blocked, not which ones.
A fingerprint is not anonymous: someone who guessed the address could check it against the fingerprint. It simply means Whence never holds the address in plain text.
Sending sales to ad platforms: 7 days, with marketing consent
Ad platforms match a sale to an ad click more reliably when they receive the buyer’s IP address with the browser. So when at least one conversion destination is turned on, the shopping events Whence receives for conversions (page and product views, add to cart, checkout steps, purchase) keep the visitor’s IP address, only if the visitor allowed marketing.
- It is sent as a matching key to Meta, TikTok, Snapchat, Pinterest and Reddit, in plain text, as their conversion APIs require.
- It is erased from Whence after 7 days, the age after which platforms refuse an event. The event itself stays its 90 days.
- A visitor without marketing consent never has their IP address kept, and neither does anyone while no destination is on.
See Match quality for how much each matching key helps.
Consent records and access requests
- Consent records: Whence no longer collects new ones. Those already collected keep no IP address (the visitor’s region comes from the country, as above), and are kept 24 months, then deleted.
- If a person asks for their data within those 7 days, the IP address on their shopping events is part of the file (Access and erasure requests).