What data leaves my site when I install the widget?
When you install the widget on your site, here is exactly what data is transmitted.
Data sent when the page loads
When a visitor loads a page carrying your widget, one request goes out for the widget script. It carries two identifiers:
- Your public widget key (
data-key) - Your board slug (
data-board)
Those tell us which workspace the widget belongs to. Nothing else is sent at load time.
What never leaves at load time
- No cookies at all. Every widget request is sent with credentials omitted, so cookies are never even attached. The chat thread is remembered in your visitor's own browser storage, not in a cookie.
- No browser fingerprinting.
- No third-party analytics or tracking pixels of any kind.
- No page content, no form data, no reading of your DOM.
Data sent when a visitor uses the widget
Only when someone types and sends a message does conversation data leave your site:
- The message text
- A thread identifier, so a returning visitor sees their conversation
- Their name and email, only if they choose to provide them
That is the whole payload. It travels over HTTPS and is stored scoped to your workspace, reachable only by your team.
One optional exception, off by default
If you switch on error capture (Signals), the page URL is included in error reports so you can see where a problem happened. That is the only feature that sends a URL, and it does nothing unless you enable it.
About the Shadow DOM
The widget renders inside a Shadow DOM. That means its markup and styles cannot collide with your site's, so it will not inherit or break your CSS. It is a styling boundary, not a security sandbox: like any script you add to a page, it runs in your page's JavaScript context.
Security controls you set
On Dashboard, Install, Allowed origins you list the domains allowed to load your widget. Copy the embed snippet to a domain that is not on that list and it will not activate.
Nothing runs on your server
The widget is a single script tag in the visitor's browser. It installs nothing on your server, touches no database, and changes no files.
Your data
We do not sell personal data, and we do not use end-customer support content to train third-party AI models. For specific GDPR or data-residency questions, contact support and a human will pick it up.