What is collected, what happens before consent, and where the data lives.
Self-hosted
firstrun runs on the operator’s own infrastructure and stores everything in their own Postgres. Events go to https://app.firstrun.app and nowhere else. There is no vendor account, no third party in the path, and no data shared between operators.
The browser tag is consent-gated
Before consent the tag writes nothing to the browser and sends nothing to a server: no cookie, no storage entry, no visitor id. What it observes is held in memory, so a visit that begins on your banner is still counted as one visit if the answer is yes. Withdrawing consent deletes the id, the session state and anything still held.
JavaScript
fr("consent", true); // yesfr("consent", false); // no, or withdrawn later
Call it from whatever consent banner you already run. The tag does not ship one.
Desktop, mobile and server clients are not gated, because there is no third party on the other end to ask: they are your own software reporting on itself, covered by your own privacy notice.
What is collected
From the browser, after consent: pages viewed, referrer, UTM parameters, session boundaries, time and scroll depth on a page, outbound and file link clicks, form submissions, Core Web Vitals, and a random visitor id stored in that browser.
From an app or a server: the events that software writes, plus app version, release channel, operating system, architecture, locale, and a random id generated on that machine or supplied per request.
From you: whatever you choose to put in a name, an attribute, or an identify() call. An error event carries the exception type, message and stack you hand it.
What is not collected
No session replay, no keystrokes, no screenshots, no form field contents.
No browser fingerprinting and no hardware fingerprinting. Every id is a random value the person’s own device stores and can delete.
No stored IP address, no geolocation lookup, no advertising identifiers, no third-party pixels, no cross-site tracking.
No linking of one source to another, and no identity shared between projects. See Identity.
What you can tell your users
Three sentences that are true and that most privacy notices can absorb as they are:
Analytics on this site store nothing and send nothing until you accept them.
If you accept, we record which pages you view, under a random id kept in your browser.
Your IP address is not stored, and the data is held on our own servers rather than sent to an analytics company.
Behaviour, not legal advice. This page describes what the software does. Whether that needs consent where you operate, and what your notice has to say, is a question for somebody qualified to answer it.