Snippet privacy and consent

For website owners who install the Twinpage snippet. This page describes what the snippet does; it is not legal advice.

In plain words

What the snippet stores in a visitor's browser

The snippet uses the browser's local and session storage. It does not set cookies.

The visitor ID, the visitor profile (st_p) and the flags above stay in the visitor's browser and are never sent to Twinpage. The experiment and version (and, for an extra metric, the metric) are sent with each view or conversion, as described below, without any visitor identifier. If storage is blocked, the snippet keeps the values in memory for the current page view only.

What the snippet sends to Twinpage

• When a page loads: your site key and the snippet's version number (to check the snippet is installed and to fetch your running experiments).
• When a visitor sees an experiment or converts: your site key, the experiment, the version, whether it was a view or a conversion, and, for an extra metric, which metric.
• If a version uses custom JavaScript: a request for that code (see below).

The snippet itself does not send the visitor ID, the page's content, or anything typed into a form; custom JavaScript you add is your own code and is covered below. As with any web request, the visitor's IP address and browser details reach our servers and our hosting provider's logs. We do not store them in our database.

Google Analytics 4 (only if you turn it on)

Off unless you turn on "Send experiment data to Google Analytics 4" in a project's settings. Then, once per visitor per browser session for each experiment, the snippet passes a twinpage_exposure event to the Google tag or Google Tag Manager already on your page, with the experiment's ID and name, and the version's ID and name (for example Control or Variant B). That data goes from the visitor's browser to your own Google Analytics account; it is not sent to Twinpage. The snippet adds no visitor ID, page address or form input to it; Google Analytics records what it normally records with every event, under your settings. If you turn it on, mention it in your own privacy notice.

What the snippet does not do

It does not set cookies, follow visitors across other websites, or read form fields. It reads the elements your experiments select, to change them or to count clicks on them. If an experiment uses targeting, it also reads, in the visitor's browser, the browser's user-agent string and touch support (to tell device type), the page address's utm_medium parameter and the referring site (to tell traffic source), and keeps only the result in st_p. None of this is sent to Twinpage.

Custom JavaScript (only if you turn it on)

Off unless you turn on "Allow custom JavaScript on this project" in a project's settings (Growth plan). Then, for a version with custom JavaScript, the snippet loads your code from Twinpage with a normal script request. Like any script request, it carries the visitor's IP address, browser details and, depending on your site's referrer policy, the page address; we read none of it, and store and log nothing about the visitor (our hosting provider keeps its standard request logs). Your code then runs on your page with the same access as any other script on it. What it does there, such as setting cookies, reading forms or sending data elsewhere, is your processing, not ours, and the statements above about what the snippet does not do don't cover it. Describe it in your own privacy notice and consent banner.

Do you need consent?

Rules such as the EU and UK ePrivacy rules can require a visitor's consent before information is stored on their device, unless that storage is strictly necessary for something the visitor asked for. Whether A/B testing counts as strictly necessary differs between countries and regulators, and many treat it as needing consent. Other countries have their own rules. We cannot decide this for you: ask your legal adviser.

Loading the snippet only after consent

If you need consent, load the snippet only once the visitor has accepted the relevant category in your consent banner. Until it loads, nothing is stored and nothing is sent, and the visitor sees your original page. Call the function below from your consent banner when the visitor accepts:

<script>
function loadTwinpage() {
  var s = document.createElement("script");
  s.src = "https://twinpage.app/snippet.js";
  s.async = true;
  s.setAttribute("data-site-key", "YOUR_SITE_KEY");
  document.head.appendChild(s);
}
</script>

• Replace the site key with your project's key from the Install snippet panel (under Advanced).
• Use this loader instead of the dashboard's install block, not with it. The block's first two lines hide the page until the snippet runs; before consent the snippet never runs, so the page would stay hidden briefly on every page load.
• The small stub that queues Twinpage.track calls before the snippet loads only keeps them in memory, so you can leave it in place.

If a visitor withdraws consent

Stop loading the snippet for them. To remove what it already stored, run this when they withdraw:

<script>
["localStorage", "sessionStorage"].forEach(function (name) {
  var store = window[name];
  Object.keys(store)
    .filter(function (key) { return key.indexOf("st_") === 0; })
    .forEach(function (key) { store.removeItem(key); });
});
</script>

Your own privacy notice

Your privacy notice should say that you run A/B tests and describe the storage above. You are welcome to link to this page.

Data processing agreement

For the visitor data the snippet handles, you are the controller and we are your processor. Our Data Processing Agreement forms part of our Terms of Service and applies automatically; you don't need to ask for it.