OnRampData & Privacy Policy
OnRamp is an onboarding analytics service for web and mobile apps. This page explains how visitor analytics is processed and what customers need to disclose to their users.
Last updated: 17 July 2026
Anonymous web analytics uses no browser storage
OnRamp's web SDK does not set or read cookies and does not use localStorage or sessionStorage for anonymous analytics. It creates a daily pseudonymous ID on the server from request data; the random salt expires at UTC midnight. This design avoids client-side storage, but it does not remove the need to assess your own legal basis, notice, and local requirements. Calling identify() sends the traits you supply and is your responsibility to govern.
Mobile SDK storage
Collected automatically
| Field | What it is |
|---|---|
| Anonymous identifier | Web: a daily, non-reversible ID derived at ingestion from the request IP address and user agent using a random salt that expires at UTC midnight. Mobile: a random SDK ID stored on the device so app launches can be linked. |
| Session ID | Groups events into a visit. Web sessions are held server-side for up to 30 minutes of inactivity; mobile SDKs keep session state on the device. |
| Timestamps | When the event happened on the device (client_ts) and when it was received by our servers (server_ts). |
| Platform & device info | Platform (iOS / Android / web), OS version, device type (phone / tablet / desktop), and device model. |
| App version | Only collected if you pass appVersion to OnRamp.init(). Used to break down funnel metrics by release. |
| Country, region & city | Derived from the request IP at ingestion time. The raw IP address and user agent are used transiently and are not stored in analytics data. |
| Step name, step index, event type | The funnel milestone your code calls OnRamp.step() with, its position in the funnel, and the event category (e.g. step_entered). |
Only if you pass it
| properties | A key-value object you can attach to any OnRamp.step() call. You decide what goes here and it is stored with the event. Do not send personal or sensitive data unless you have a documented lawful basis. Examples: { plan: "free", source: "invite" }. |
| identify() traits | If your app calls OnRamp.identify(), the traits you pass (for example email or userId) are stored as an identify event and may be used to match sessions to connected integrations such as Stripe or RevenueCat. This is optional. Calling it changes the privacy posture: you must provide the required notice, lawful basis, and consent where applicable. |
Be thoughtful about what you pass in properties or identify() - avoid including names, emails, or other PII unless you have a clear reason and have disclosed it to your users.
Never collected
- ✓Screen recordings or screenshots
- ✓Raw IP addresses or user-agent strings in analytics data
- ✓Persistent browser identifiers, cookies, localStorage, or sessionStorage for anonymous web analytics
- ✓Payment card numbers, government IDs, or sensitive PII
- ✓Names or email addresses unless you explicitly pass them via identify() or properties
- ✓User IDs or account identifiers unless you explicitly pass them via identify() or properties
Data retention
| Event data (ClickHouse) | 13-month rolling window |
| Heartbeat events | 7 days |
| Web session state (Redis) | Up to 30 minutes after inactivity |
| Location data (country/region/city) | Stored with the event for up to 13 months |
| API key hashes | Until you revoke the key |
How your data is used
Event data is used exclusively to compute the funnel metrics shown in your OnRamp dashboard - step-level conversion rates, drop-off, timing, session timelines, and journey maps. OnRamp does not create screen recordings or screenshots.
We do not sell, share, or license your data to third parties. We do not use it to train models or for advertising.
Each app's data is scoped to its API key and is only accessible to members of your OnRamp account.
Roles, lawful basis & rights
For analytics collected through a customer's app, the customer normally acts as the data controller and OnRamp acts as its processor. The customer decides the purpose, lawful basis, and which event properties or identity traits are sent.
Pseudonymous analytics can still involve personal data. Customers must provide a clear privacy notice, assess the applicable lawful basis and local rules, minimise collection, and handle access, deletion, and objection requests. A Data Processing Agreement is available on request.
For deletion requests relating to OnRamp data, contact privacy@getonramp.dev with the relevant app and identifier where available.
Infrastructure
OnRamp runs on Railway (EU region - Netherlands). Event data is stored in ClickHouse and account/funnel metadata in PostgreSQL. No event data leaves these systems except to render your dashboard.
Questions?
Email us at privacy@getonramp.dev.