OnRampData & Privacy Policy
OnRamp is an onboarding analytics service for web and mobile apps. This page explains how visitor analytics is processed and what customers need to disclose to their users.
Last updated: 20 August 2026
Data protection & security
Encryption in transit: all traffic to and from OnRamp - the SDKs, the dashboard, and every API endpoint - is served over HTTPS/TLS.
Encryption at rest: credentials for every connected integration (Google Ads, Google Search Console, Stripe, RevenueCat, Paddle, Lemon Squeezy) are encrypted at rest with AES-256-GCM before being stored, and are only decrypted server-side, in memory, to make the specific API call an integration needs.
Access control: each app's data and connected integrations are scoped to that app's API key and accessible only to members of the OnRamp account that owns it. Sensitive fields are never exposed in client-side code or logs.
Infrastructure: OnRamp runs on Railway (EU region - Netherlands), with event data in ClickHouse and account/integration metadata in PostgreSQL - see Infrastructure below for details.
To report a security concern, contact hello@getonramp.dev.
Anonymous web analytics uses no browser storage
OnRamp's web SDK does not set or read cookies and does not use localStorage or sessionStorage for anonymous analytics. It creates a daily pseudonymous ID on the server from request data; the random salt expires at UTC midnight. This design avoids client-side storage, but it does not remove the need to assess your own legal basis, notice, and local requirements. Calling identify() sends the traits you supply and is your responsibility to govern.
Mobile SDK storage
Collected automatically
| Field | What it is |
|---|---|
| Anonymous identifier | Web: a daily, non-reversible ID derived at ingestion from the request IP address and user agent using a random salt that expires at UTC midnight. Mobile: a random SDK ID stored on the device so app launches can be linked. |
| Session ID | Groups events into a visit. Web sessions are held server-side for up to 30 minutes of inactivity; mobile SDKs keep session state on the device. |
| Timestamps | When the event happened on the device (client_ts) and when it was received by our servers (server_ts). |
| Platform & device info | Platform (iOS / Android / web), OS version, device type (phone / tablet / desktop), and device model. |
| App version | Only collected if you pass appVersion to OnRamp.init(). Used to break down funnel metrics by release. |
| Country, region & city | Derived from the request IP at ingestion time. The raw IP address and user agent are used transiently and are not stored in analytics data. |
| Step name, step index, event type | The funnel milestone your code calls OnRamp.step() with, its position in the funnel, and the event category (e.g. step_entered). |
Only if you pass it
| properties | A key-value object you can attach to any OnRamp.step() call. You decide what goes here and it is stored with the event. Do not send personal or sensitive data unless you have a documented lawful basis. Examples: { plan: "free", source: "invite" }. |
| identify() traits | If your app calls OnRamp.identify(), the traits you pass (for example email or userId) are stored as an identify event and may be used to match sessions to connected integrations such as Stripe or RevenueCat. This is optional. Calling it changes the privacy posture: you must provide the required notice, lawful basis, and consent where applicable. |
Be thoughtful about what you pass in properties or identify() - avoid including names, emails, or other PII unless you have a clear reason and have disclosed it to your users.
Never collected
- ✓Screen recordings or screenshots
- ✓Raw IP addresses or user-agent strings in analytics data
- ✓Persistent browser identifiers, cookies, localStorage, or sessionStorage for anonymous web analytics
- ✓Payment card numbers, government IDs, or sensitive PII
- ✓Names or email addresses unless you explicitly pass them via identify() or properties
- ✓User IDs or account identifiers unless you explicitly pass them via identify() or properties
Data retention
| Event data (ClickHouse) | 13-month rolling window |
| Heartbeat events | 7 days |
| Web session state (Redis) | Up to 30 minutes after inactivity |
| Location data (country/region/city) | Stored with the event for up to 13 months |
| API key hashes | Until you revoke the key |
How your data is used
Event data is used exclusively to compute the funnel metrics shown in your OnRamp dashboard - step-level conversion rates, drop-off, timing, session timelines, and journey maps. OnRamp does not create screen recordings or screenshots.
We do not sell, share, or license your data to third parties. We do not use it to train models or for advertising.
Each app's data is scoped to its API key and is only accessible to members of your OnRamp account.
Google user data (Ads & Search Console)
OnRamp offers optional integrations that let you connect your own Google Ads and Google Search Console accounts so their metrics can be shown alongside your funnel data. Connecting is your choice, per app, and requests only the following scopes:
https://www.googleapis.com/auth/adwords- read campaign, ad group, and cost/conversion data for the Google Ads accounts you explicitly authorize.https://www.googleapis.com/auth/webmasters.readonly- read-only access to list your verified Search Console properties and their performance data.
We do not request any other Google scope, and these integrations never access your Gmail, Drive, Calendar, or Google Account profile data.
OAuth tokens are encrypted at rest (AES-256-GCM), scoped to the connecting app, and decrypted only server-side to make the specific API calls the integration needs. OnRamp's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: this data is used only to display Ads and Search Console metrics in your OnRamp dashboard, is never used for advertising, is never used to train AI or machine learning models, and is never sold or shared with third parties.
You can disconnect a Google integration at any time from your app's Settings, which immediately deletes the stored token from our database. You can also revoke OnRamp's access directly from your Google Account permissions page.
Roles, lawful basis & rights
For analytics collected through a customer's app, the customer normally acts as the data controller and OnRamp acts as its processor. The customer decides the purpose, lawful basis, and which event properties or identity traits are sent.
Pseudonymous analytics can still involve personal data. Customers must provide a clear privacy notice, assess the applicable lawful basis and local rules, minimise collection, and handle access, deletion, and objection requests. A Data Processing Agreement is available on request.
For deletion requests relating to OnRamp data, contact hello@getonramp.dev with the relevant app and identifier where available.
Infrastructure
OnRamp runs on Railway (EU region - Netherlands). Event data is stored in ClickHouse and account/funnel metadata in PostgreSQL. No event data leaves these systems except to render your dashboard.
Questions?
Email us at hello@getonramp.dev.