Privacy and analytics
This page explains what the Leptis Magna website, the site of a Libyan extra virgin olive oil, measures about your visit, what it stores in your browser and how to say no. The site has no accounts, forms or shop, so it never asks for your name, email or phone number.
What do our own analytics record?
A small script (/tracker.js) sends visit and event data to /t/ on this same domain. It does not share that data with advertisers. When you open the site, it records one visit with:
- the page you landed on, and the domain of the site that sent you (only the domain, not the full address);
- campaign tags in the link, if any (utm_source, utm_medium, utm_campaign, utm_term, utm_content);
- the language you're reading in and your screen size;
- device type, operating system and browser, worked out from your browser's user-agent string;
- an approximate country and city, when they can be looked up from your IP address in a GeoIP database on our own server;
- whether you gave consent, and whether you are a returning visitor (only if you gave consent);
- a traffic source we work out from the above, such as search, social media or a likely scan of the code on the bottle.
During the visit it records these events:
- page views (the page address and language);
- which parts of a page came into view;
- how far you scrolled (25%, 50%, 75% and 90%);
- moving to the next step in the tasting guide on the home page;
- switching language;
- engaged time: the number of seconds the page was visible on your screen.
Known bots and crawlers are not recorded.
What happens to your IP address?
Our analytics never store your IP address. They use it for two things, then discard it:
- to look up an approximate country and city in a local database, with no call to an outside service;
- to make a one-way hash with a secret key that changes every day. The hash is stored instead of the IP. Because the key changes daily, hashes from different days can't be matched to each other.
If you haven't given consent, we tell visits apart with a similar daily key built from that hash plus your device type, operating system, browser, screen size and language. It also changes every day.
What is stored in your browser?
| Key | Where | What it holds | When |
|---|---|---|---|
| leptis.consent | localStorage | Your choice: “granted” or “denied” | After you press Accept or Decline |
| leptis.lang | localStorage | The last language you viewed (ar or en) | Every visit |
| leptis.vid | localStorage | A random visitor ID, so we can tell new from returning visitors | Only after you press Accept |
| leptis.sid and other leptis.* keys | sessionStorage | A random session ID, the page you landed on with its referrer and campaign tags, and the progress of the current visit | Every visit; deleted when you close the tab |
None of these keys holds your name, contact details or IP address. The visitor ID and session ID are random values made in your browser.
How do we use Google Analytics?
The site also loads Google Analytics 4 (measurement ID G-VGVZJVS71Q) with Google's Consent Mode v2. Every consent type starts as denied: analytics storage, ad storage, ad user data and ad personalization.
- The Google tag loads as soon as the page opens, before you choose. Until you press Accept, and if you decline, it does not read or write analytics cookies, but it still sends Google what Google calls “cookieless pings”: the consent state and basic measurements without cookies.
- When you press Accept, only analytics storage is switched to granted, so Google Analytics can set its cookies. The three advertising types stay denied.
- Google Analytics receives page views and the same events as our own analytics, except engaged time, plus one event when a visit looks like a scan of the code on the bottle.
Google's own handling of this data is described in how Google uses information from sites that use its services.
Does the site contact any other services?
Yes, one: the fonts are loaded from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), so your browser connects to Google's servers to download them. Images and videos are served from this site.
How long do we keep the data?
Our own analytics records (the visits and events described above, including the daily IP hash and approximate location) have no automatic deletion date by default. Automatic clean-up can be switched on separately for visits and for events; when it is on, records older than the chosen period are deleted permanently. Google Analytics data is kept according to the retention setting of our Google Analytics property.
How can you say no or clear the data?
- Press Decline on the banner. No visitor ID is set, any old one is deleted, and Google Analytics cookies are not set.
- To change your choice later, clear this site's data in your browser settings (this removes the leptis.* keys and any Google Analytics cookies). The banner will appear again on your next visit.
- Private or incognito windows delete everything when you close them.
- Blocking JavaScript stops all analytics on this site. The pages still work.