Skip to content
Docs / Privacy and consent

Privacy

Privacy and consent

How Heatwave respects your cookie banner, what it hides, and wording for your own privacy policy.

Heatwave is built to collect as little as possible. Visitors are anonymous, nothing anyone types is recorded, and tracking follows your store’s cookie settings.

Heatwave follows Shopify’s Customer Privacy settings, the same ones your cookie banner uses.

  • Where visitors are asked for consent, nothing is collected until they allow analytics. Before that, Heatwave sends nothing at all.
  • If a shopper accepts on the banner, tracking starts right away on that page.
  • If a shopper declines, they’re never tracked or counted.
  • Global Privacy Control and Do Not Track are always respected. If a shopper’s browser sends either signal, Heatwave doesn’t run, whatever your banner says.
  • The web pixel that reports checkout steps only runs for visitors who allow analytics.

Whether a banner is shown, and to whom, depends on your store’s own privacy settings in Shopify.

Anonymous by design

Each visitor gets a random code saved in their browser, so return visits can be recognised. It isn’t linked to a name, email address or Shopify customer. The visitor’s IP address is used only to look up their country and is never stored.

Masking in recordings

These are hidden in the shopper’s browser, before any data is sent:

  • Everything typed into any field, and hidden form values
  • Email addresses and phone numbers anywhere on the page
  • Address and account areas
  • Embedded frames, for example payment or chat widgets
  • Any elements you add in Settings > Privacy > Extra elements to hide in recordings

Email addresses and phone numbers are also masked in button and link text and in campaign tags. Page addresses are saved without query strings, and customer IDs, email addresses and access tokens in addresses are replaced.

Developers can also mark elements in the theme code: data-hw-mask hides an element’s text in recordings, and data-hw-block leaves the element out of recordings completely.

Pages that are never tracked or recorded

  • Shopify checkout is never recorded. Checkout steps (started, payment submitted, completed) come from Shopify’s own customer events and are linked by a one-way code, never the checkout’s own reference.
  • Customer account pages (login, orders, addresses) are never recorded.
  • Pages you exclude under Settings > Privacy > Pages never tracked collect nothing at all.

What Heatwave never collects

  • Names, email addresses, phone numbers or postal addresses
  • Anything typed into forms, search boxes or the cart note
  • Passwords, card numbers or any payment details
  • IP addresses (only the visitor’s country is kept)
  • Customer accounts, order details or anything from Shopify checkout pages
  • Shoppers who decline analytics cookies or use Global Privacy Control

For the full list of what is collected, field by field, open the Your data page in Heatwave. See Your data and deletion.

AI and your data

To write recommendations, Heatwave sends Anthropic’s Claude pictures of your pages taken by Heatwave’s own browser (not your shoppers’ screens), the numbers for that page type, and short anonymous visit summaries. This data isn’t used to train AI models.

Text for your privacy policy

The Your data page in Heatwave has suggested wording you can paste into your store’s privacy policy, with a Copy text button. It fills in your plan’s retention period for you. Here it is, with the number of days left for you to fill in:

We use Heatwave to understand how visitors use our store so we can improve it. Where cookie consent is required, Heatwave only runs if you allow analytics cookies. Heatwave records anonymous information about your visit: the pages you view, where you click and scroll, your device type, browser and country, and cart activity. Some visits are recorded as an anonymous replay of the page. Anything you type, email addresses, phone numbers and account pages are hidden before data leaves your browser. Heatwave does not store your name, contact details, payment details or IP address. The data is kept for [30, 90 or 365] days and then deleted automatically. Heatwave uses Anthropic's Claude AI to analyse aggregated, anonymous data; it is not used to train AI models.

Replace [30, 90 or 365] with your plan’s retention: 30 days on Free, 90 on Starter, 365 on Growth and Pro. This is a suggestion, not legal advice, so check it with your own adviser.

For Heatwave’s own legal documents, see the Privacy policy, Data processing agreement and Sub-processors.