Privacy and security
Are IP addresses stored?
IP addresses are not stored, neither raw nor as a checksum. Metrunio processes them only in transit and to limit requests. Since 14 October 2026 Metrunio no longer forms the truncated checksum that used to sit on measurement events; existing values have been deleted. Customer numbers and email checksums you pass are likewise pseudonymised on receipt, per account.
How does Metrunio handle IP addresses and customer numbers?
Why no checksum any more? No query, report or export read it. Whatever has no purpose is not stored, not even as a pseudonym. Rate limiting works with the address only at the moment the request arrives.
The application logs do not contain the address either. The cloud platform’s logs outside the application are configured not to record it; details are in the privacy notice.
Note
Separate from this are the checksums without an account reference from sign-in, sessions and signing the agreement in the portal. They belong to your own Metrunio account, not to the measurement data of your visitors.
Customer numbers and email checksums
The Shopify app and the Shopware plugin send the SHA-256 of the lower-cased email address. That checksum is the same for the same address everywhere. Metrunio therefore does not store it as it arrives but first combines it with your account’s key. The same applies to a customer number from identify() and to any user_id_hash your server sends. The same shopper thus has two identifiers in two shops on Metrunio, and they have nothing to do with each other.
Last reviewed on 13 Oct 2026
Also asked
- IP anonymisation
- Is the IP stored?
- Pseudonymisation
- Is the hashed email address stored?
- Is an IP hash stored?
Related articles
- Which data is stored?
What exactly does Metrunio hold about my website’s visitors?
Pseudonymous identifiers, event data with timestamps, campaign and click identifiers, and conversion values. No raw IP addresses; event fields are not meant to hold plain-text names or contact details. Detected email addresses and phone numbers cause rejection; the automatic check does not detect every kind of personal data, though.
- Which attributes are linked?
How does Metrunio know that two signals belong together?
Only through unambiguous identifiers: session ID, pseudonymous first-party ID, click ID, impression ID, view identifier, pseudonymised customer identifier, and order or lead number. Nothing else.