TrackSure Cloud – Server Side Tracking, Meta Pixel CAPI, GA4, Conversion Tracking & Analytics for WordPress & WooCommerce vs LayerSync – Conversion Tracking, Pixel Manager, and Server-Side API

Overview LayerSync is server-side conversion tracking for WooCommerce. It captures ecommerce events and forwards them through the LayerSync SaaS to ten ad and analytics platforms via their server-side APIs — Meta (Conversions API), Google Analytics 4 (Measurement Protocol), Google Ads (Enhanced Conversions), TikTok (Events API), Pinterest, Snapchat, LinkedIn, Reddit, X (Twitter), and Microsoft Ads (Bing UET). Configuration lives in the LayerSync dashboard, so there’s no Google Tag Manager server container, no custom tracking subdomain, no external hosting to manage. The plugin handles WooCommerce; LayerSync handles per-platform delivery. Why Server-Side Tracking Browser pixels are increasingly blocked by ad-blockers and degraded by Safari/iOS tracking-prevention. Sending the same events server-to-server restores conversion data your ad platforms use to optimize. LayerSync ships WooCommerce events over HMAC-signed HTTPS to the LayerSync hub, which calls each platform’s CAPI with a shared event_id so browser and server halves are deduplicated automatically. What’s Included Ten ad platforms, one plugin — Meta CAPI, GA4 MP, Google Ads Enhanced Conversions, TikTok Events API, Pinterest CAPI, Snapchat CAPI, LinkedIn CAPI, Reddit CAPI, X CAPI, Microsoft Ads (Bing UET). Browser pixels + server-side CAPI for all of them, with automatic deduplication. WooCommerce funnel coverage — view item, add to cart, view cart, begin checkout, add payment info, purchase, refund. HPOS-compatible. Triple-fallback purchase capture (payment_complete + checkout_order_processed + woocommerce_thankyou) so custom checkouts still fire. Lead-form auto-detect — eight form libraries: Contact Form 7, WPForms, Ninja Forms, Formidable Forms, Gravity Forms, Fluent Forms, Elementor Pro Forms, Forminator — plus WooCommerce checkout forms. Consent & CMP auto-detect — bridges WP Consent API and auto-detects eight CMPs: Complianz, Cookiebot, CookieYes, Borlabs Cookie, iubenda, OneTrust, GDPR Cookie Compliance (Moove), Termly. Strips PII automatically when ad_user_data is denied. Action Scheduler-backed queue — per-row dispatch via Action Scheduler with WP-Cron fallback. Configurable retention (default 30 days), priority lanes (purchases never evicted), dead-letter UI with operator Replay. Historical backfill — replay up to 365 days of WooCommerce orders to LayerSync after install or after an outage. Dry-run mode shows what will be queued before any event ships. Bot & proxy intelligence — multi-signal scoring (datacenter IPs, Apple Private Relay, UA heuristics, velocity, repeated event IDs). Daily-refreshed CIDR list for fresh detection between releases. Operator safe-list overrides. International phone normalization — 50+ country codes with E.164 canonicalization, dummy-number rejection, and platform-specific hash forms (digits-only for Meta, E.164 for TikTok/Snapchat/Pinterest). 508+ automated tests — PHPUnit coverage on identity, queue retry, encryption, bot scoring, CMP detection, and form adapters. Audit the suite at tests/Unit/. Browser-side recovery engine — save-first localStorage queue, priority-aware overflow (purchases never dropped), cross-tab serialization, exponential backoff with jitter, multi-day retention (up to 30 days for purchases), sendBeacon on page exit. Privacy & compliance — per-event consent snapshot, default-denied mode, CMP integration via window.LayerSync.setConsent(), SHA-256 PII hashing, IP anonymization, GDPR / UK ICO / CCPA-aware (Meta Limited Data Use, Do-Not-Sell drop mode). Operational visibility (via the LayerSync hub) — real-time event status, per-platform delivery success rates, anomaly detection, Slack/PagerDuty/email digest alerts (paid plans). Free vs Paid Plans Free includes browser pixels for all 10 platforms, server-side CAPI to one platform of your choice, 1 site, 1 team seat, 10,000 events/month, WooCommerce + lead-form auto-tracking, event quality scoring, real-time event log. Paid plans add: server-side CAPI to all 10 platforms, higher event quotas, multiple sites, team seats, Slack/PagerDuty alerts, anomaly detection, audience builder, ROI dashboard, user journeys, customer profiles, automatic conversion recovery, custom event definitions, white-label (enterprise), custom ingest domain (enterprise). Compare Plans For Developers LayerSync exposes a JavaScript API, a same-origin REST endpoint, and WordPress hooks for custom event tracking. JavaScript API: window.LayerSync.track('lead', {email: '[email protected]', value: 25.00, currency: 'USD'}); window.LayerSync.setConsent({ad_storage: 'granted', ad_user_data: 'granted'}); REST endpoint (same-origin, nonce-protected, survives ad-blockers and corporate firewalls): POST /wp-json/layersync/v1/events WordPress filter hooks: layersync_event_payload, layersync_event_before_enqueue, layersync_event_after_delivery, layersync_consent. Full API documentation: layersynchub.com/docs. Compatibility Works alongside Cookiebot, CookieYes, OneTrust, Borlabs Cookie, Complianz, and any CMP that supports a JS consent callback. Compatible with WP Rocket, LiteSpeed Cache, W3 Total Cache, Cloudflare, and other major caching/CDN solutions. Getting Started Sign up at layersynchub.com and create your first site. Install and activate LayerSync from the WordPress plugin directory. Visit LayerSync → Settings in wp-admin and paste your API key, API secret, and Site ID. Click Test connection — once green, configure your platforms (Meta Pixel ID, GA4 Measurement ID, etc.) in the LayerSync dashboard. Events start firing within seconds; check the Live Events tab to confirm. External services This plugin connects to external third-party services to provide its functionality. Below is a complete list of all external services, when they are called, what data is transmitted, and links to their terms of service and privacy policies. LayerSync SaaS Hub (Always Active): Service: LayerSync (https://layersynchub.com) Purpose: Receives every WooCommerce / form / page event from your site and dispatches matching Conversions API calls to each connected ad platform. Stores the order ledger for conversion recovery, the queue table for outage survivability, and provides the configuration dashboard for your platforms. What data is sent: Event name, timestamp, hashed user data (email, phone, name SHA-256), product/order data (SKU, value, currency, quantity), browser-side context (page URL, referrer, user agent, IP — IP can be anonymized in settings), event_id for deduplication, consent snapshot When it’s sent: When a tracked event occurs (page view, product view, add to cart, purchase, refund, lead, etc.). Browser-side: sent via the same-origin REST proxy. Server-side: sent from PHP via WordPress HTTP API. Service provider: LayerSync Terms of Service: https://layersynchub.com/terms Privacy Policy: https://layersynchub.com/privacy When You Enable Meta Pixel / Conversions API: Service: Meta (Facebook) Graph API Purpose: Send conversion events to Meta for ad optimization What data is sent: Event name, timestamp, hashed user email/phone, click ID (fbclid / fbp / fbc), product SKU, revenue, IP, user agent, Pixel ID When it’s sent: Automatically when a tracked event occurs and Meta is enabled in your LayerSync dashboard Service provider: Meta Platforms, Inc. Terms of Service: https://www.facebook.com/legal/terms Privacy Policy: https://www.facebook.com/privacy/policy When Loading Meta Pixel Script (If Enabled): Service: Facebook Connect CDN Purpose: Load fbevents.js for browser-side Meta Pixel What data is sent: Standard HTTP request data (IP, user agent, referrer) When it’s sent: On every page load when Meta browser tracking is enabled Script URL: https://connect.facebook.net/en_US/fbevents.js When You Enable Google Analytics 4 / Google Ads: Service: Google Analytics 4 Measurement Protocol + Google Ads API Purpose: Send analytics + conversion events to Google for reporting and ad optimization What data is sent: Event name, page URL, referrer, session ID, client ID, IP, user agent, device info, hashed user data for Enhanced Conversions Service provider: Google LLC Terms of Service: https://marketingplatform.google.com/about/analytics/terms/us/ Privacy Policy: https://policies.google.com/privacy When Loading Google Tag Script (If Enabled): Service: Google Tag Manager CDN Purpose: Load gtag.js for browser-side GA4 + Google Ads tracking Script URL: https://www.googletagmanager.com/gtag/js When You Enable TikTok Events API: Service: TikTok Business API Purpose: Send conversion events to TikTok for ad optimization Script URL (if browser pixel enabled): https://analytics.tiktok.com/i18n/pixel/events.js Privacy Policy: https://www.tiktok.com/legal/privacy-policy When You Enable Pinterest Conversions API: Service: Pinterest Tag + Conversions API Purpose: Send conversion events to Pinterest for ad optimization Script URL (if browser pixel enabled): https://s.pinimg.com/ct/core.js Privacy Policy: https://policy.pinterest.com/en/privacy-policy When You Enable Snapchat Conversions API: Service: Snap Pixel + Conversions API Purpose: Send conversion events to Snapchat for ad optimization Script URL (if browser pixel enabled): https://sc-static.net/scevent.min.js Privacy Policy: https://snap.com/en-US/privacy/privacy-policy When You Enable LinkedIn Insight Tag + Conversions API: Service: LinkedIn Marketing API Purpose: Send conversion events to LinkedIn for ad optimization Script URL (if browser pixel enabled): https://snap.licdn.com/li.lms-analytics/insight.min.js Privacy Policy: https://www.linkedin.com/legal/privacy-policy When You Enable Reddit Pixel + Conversion API: Service: Reddit Ads API Purpose: Send conversion events to Reddit for ad optimization Script URL (if browser pixel enabled): https://www.redditstatic.com/ads/pixel.js Privacy Policy: https://www.reddit.com/policies/privacy-policy When You Enable X (Twitter) Pixel + Conversion API: Service: X Ads API Purpose: Send conversion events to X for ad optimization Script URL (if browser pixel enabled): https://static.ads-twitter.com/uwt.js Privacy Policy: https://x.com/en/privacy Important Notes: No automatic data sharing: LayerSync does NOT send any data to ad platforms unless you explicitly enable them in your LayerSync dashboard Consent-aware: LayerSync respects user consent state via the window.LayerSync.setConsent() API and only fires browser pixels and server events after consent is granted You control the data: You choose which platforms to enable, what events to track, and what user data to include (emails, phones, etc.) Required account: This plugin requires a LayerSync account to operate. The plugin alone does not function without API credentials from layersynchub.com. Privacy Policy LayerSync sends the following data to the LayerSync SaaS hub (https://layersynchub.com): Per-Event Data: Event name (e.g. purchase, add_to_cart) Timestamp Page URL and referrer User agent IP address (configurable — can be anonymized) event_id for deduplication Visitor consent snapshot at the moment of the event LayerSync first-party visitor ID (layersync_uid cookie — UUIDv4, 2-year sliding expiry) For E-Commerce Events: Product SKU, title, category, image URL, price, currency, quantity Order ID, total, currency (for purchase / refund events) For Lead / Form Events: Form ID, submission ID, field values you’ve configured as trackable Hashed User Data (when available, hashed BEFORE leaving your server): Email (SHA-256) Phone (SHA-256) First name (SHA-256) Last name (SHA-256) City, state, zip, country (SHA-256) LayerSync hashes PII server-side before forwarding to any ad platform. External Data Sharing (Only When You Enable Each Platform): Per-platform data forwarding is documented in the External services section above. No data is sent to any ad platform unless you explicitly enable it in your LayerSync dashboard. Privacy Controls: IP Anonymization: Available in Settings → Privacy. Consent Integration: Respects window.LayerSync.setConsent({...}) for Cookiebot, CookieYes, OneTrust, Borlabs Cookie, Complianz, and custom consent managers. Default-denied mode: Treats all visitors as consent-denied until a CMP signals otherwise — suitable for EU/UK traffic. Right to delete: Send a POST /api/v1/privacy/delete request to LayerSync with the visitor’s external_id (or hashed email / phone) and all matching events, audit rows, customer profile entries, landing signals, and delivery records are removed. Your Responsibilities: Disclose LayerSync’s data flow in your site’s privacy policy Obtain user consent before tracking, where required by law Configure data retention and privacy settings appropriately Honor user data-deletion requests via the LayerSync privacy API Support Documentation Support Contact us Trademarks & Third-Party Services LayerSync integrates with various third-party analytics and advertising platforms. All trademarks, service marks, and company names mentioned in this plugin are the property of their respective owners. Third-Party Platforms: Meta, Facebook, Instagram, and Facebook Pixel are trademarks of Meta Platforms, Inc. Google, Google Analytics, Google Ads, and GA4 are trademarks of Google LLC. TikTok is a trademark of ByteDance Ltd. Pinterest is a trademark of Pinterest, Inc. Snapchat is a trademark of Snap Inc. LinkedIn is a trademark of Microsoft Corporation. X (Twitter) is a trademark of X Corp. Reddit is a trademark of Reddit, Inc. WooCommerce is a trademark of Automattic, Inc. Integration Requirements: Users must have active accounts with third-party platforms to use their respective features API access requires platform-specific credentials and compliance with their terms of service Data transmission follows each platform’s API specifications and privacy policies Users are responsible for compliance with each platform’s terms of service LayerSync is an independent plugin and SaaS, and is not officially affiliated with, endorsed by, or sponsored by any of the companies mentioned above. All product names, logos, brands, and trademarks are property of their respective owners. Data Privacy: LayerSync forwards event data to enabled ad platforms only with user consent. No data is transmitted to any third party unless explicitly configured by the site administrator.

★ What Makes TrackSure Different TrackSure is the only free WordPress plugin that combines server-side conversion tracking (Meta CAPI + GA4 Measurement Protocol) with a complete first-party analytics platform — no GTM required, no external cloud, no monthly fees. Unlike PixelYourSite, TrackSure includes a full analytics dashboard — user journeys, funnels, attribution, and real-time tracking — at no extra cost. Unlike GTM-based solutions, TrackSure requires no server container setup, no custom subdomain, and no external hosting. 42% of internet users run ad blockers. 75% of iPhone users opted out of tracking. iOS 14+ reduced Meta Pixel reported conversions by 30–40% for most advertisers. TrackSure’s server-side tracking recovers conversions from all of them. For WooCommerce Store Owners If you run WooCommerce and Meta or Google Ads, TrackSure connects your real purchase data directly to your ad platform — bypassing iOS restrictions, ad blockers, and Safari cookie limits. Setup takes under 5 minutes: install, paste your Meta Pixel ID + Access Token, and your ad platform starts seeing your actual conversions. Higher Event Match Quality (EMQ) means better optimization and lower cost-per-acquisition. For Marketers & Agencies Get user journey tracking, funnel visualization, multi-touch attribution, and traffic source analysis without paying $500/month for Amplitude or Mixpanel. Five attribution models (first-touch, last-touch, linear, time-decay, position-based) and an assisted conversions report show exactly which channels drive revenue. Manage multiple client sites from the same plugin. For Developers TrackSure exposes a JavaScript API (window.TrackSure.track()), a PHP API, and WordPress hooks (tracksure_filter_event_data, tracksure_conversion_recorded) for complete custom event tracking. Full server-side control with no dependency on browser JavaScript. TrackSure Cloud fixes this with server-side tracking — sending conversion events directly from your WordPress server to Meta (Conversion API), Google Analytics 4 (Measurement Protocol), TikTok, Pinterest, and Google Ads — bypassing browser limitations entirely. Meta Pixel setup takes under 3 minutes: paste your Pixel ID and Access Token, and TrackSure handles the rest — browser pixel, Conversion API, event deduplication, and Advanced Matching for maximum Event Match Quality (EMQ). But TrackSure is more than a conversion pixel: it’s a complete first-party analytics platform with user journeys, funnel tracking, goal management, revenue attribution, and real-time analytics — all stored in your WordPress database. Ad blockers, iOS 14+ restrictions, and cookie limitations mean your browser-based tracking pixels report only a fraction of your actual conversions. When ad platforms can’t see your real sales data, they can’t optimize — and your ROAS drops. Documentation | Support | GitHub | Get Pro Why Server-Side Tracking Matters Around 40% of internet users run ad blockers. Safari limits cookies to 7 days. iOS App Tracking Transparency reduced reported conversions by 30–40% for many advertisers. When your tracking relies only on a browser pixel, these restrictions silently discard your conversion data. Server-side tracking sends conversion events directly from your server to the ad platform API. Ad blockers can’t block it. Cookie limits don’t apply. The result: your ad platforms see your real conversions, optimize better, and your ad spend delivers higher ROAS. TrackSure sends API calls directly from your WordPress server — no GTM server container, no external cloud, no routing data through third-party services. What TrackSure Does Server-Side Conversion Tracking (CAPI) Meta Conversion API — send purchase, view content, add to cart, checkout, and page view events server-to-server Google Analytics 4 Measurement Protocol — server-side GA4 event forwarding TikTok Events API and Pinterest Conversion API (Pro) Automatic browser + server event deduplication — each event gets a unique ID shared between client and server so platforms count it once First-Party Analytics Dashboard All analytics data stored in your WordPress database — you own every byte Automatic traffic source detection — organic search (Google, Bing, DuckDuckGo), social media (Facebook, Instagram, LinkedIn, TikTok), email, referrals, AI chatbots (ChatGPT, Claude, Perplexity), and direct — identified without UTM tags Session-based user journeys with 30-day attribution window (configurable) Five attribution models: first-touch, last-touch, linear, time-decay, position-based Assisted conversion reporting — see which channels helped even without getting final credit Goals, Funnels & Conversion Tracking Custom conversion goals for form submissions, purchases, downloads, video views, or any event Funnel visualization — see where visitors drop off in your checkout or signup flow Goal completion rates with trend analysis Revenue attribution — connect each sale to its traffic source, campaign, and touchpoint User Journeys & Session Tracking Complete path from first page visit to final conversion — including all touchpoints across multiple sessions Time between visits, number of sessions to convert, and which content moved visitors closer to purchasing Real-time visitors — see who is on your site now and what pages they’re viewing eCommerce Conversion Tracking Auto-tracks the full purchase funnel: product view → add to cart → checkout → purchase Works with WooCommerce and FluentCart (Free), Easy Digital Downloads, SureCart, Cartflow, and MemberPress (Pro) Revenue attribution — connect each sale to its traffic source and campaign Checkout funnel visualization with drop-off rates at each step Privacy & Compliance GDPR and CCPA ready with built-in consent manager support (Cookiebot, CookieYes, OneTrust, and more) Cookieless tracking option (uses localStorage instead of cookies — no consent banner required in some jurisdictions) IP anonymization, Do Not Track (DNT) support, and WordPress privacy tools integration No data leaves your server unless you explicitly enable an ad platform destination Who Is TrackSure For? WooCommerce & FluentCart store owners running paid ads who need more accurate conversion data for Meta, Google Ads, and other platforms Bloggers & content creators who want to see which posts bring the most traffic, engagement, and conversions Small business owners who need simple, privacy-friendly analytics without Google Analytics complexity Digital marketers managing ad campaigns who want user journey tracking, funnel visualization, and multi-touch attribution Agencies & freelancers who need analytics and conversion tracking across client sites (Pro includes white label) Privacy-focused site owners who want GDPR-compliant analytics without sending data to external services Developers who need JavaScript and PHP APIs for custom event tracking with WordPress hooks Why TrackSure All-in-one solution — server-side conversion tracking, first-party analytics, user journeys, funnels, goals, and attribution in a single plugin No GTM required — no server container setup, no custom subdomain, no separate hosting No external cloud — your analytics data stays in your WordPress database. Conversion data goes directly from your server to the ad platform API Works on any WordPress site — WooCommerce and FluentCart stores get automatic ecommerce event tracking; non-ecommerce sites use goals and custom events for leads, signups, or any conversion Five-minute setup — install, activate, and analytics data starts appearing in your dashboard. Add a Meta Pixel ID and Access Token for server-side conversion tracking Free vs Pro Free includes everything you need for analytics and conversion tracking: First-party analytics dashboard with user journeys, funnels, goals, and attribution Real-time visitor tracking Meta Pixel + Conversion API (CAPI) server-side tracking Google Analytics 4 + Measurement Protocol server-side tracking WooCommerce and FluentCart automatic ecommerce tracking All form plugins (Contact Form 7, Gravity Forms, WPForms, Fluent Forms, Elementor Forms) All page builders (Elementor, Divi, Beaver Builder, Gutenberg, WPBakery, Oxygen, Bricks) Five attribution models with assisted conversion reports Consent management integration Unlimited events and sessions Pro adds advanced ad platforms and ecommerce integrations: 14+ ad platform destinations: TikTok, Pinterest, LinkedIn, Snapchat, Reddit, Google Ads, Microsoft Ads, Twitter/X, Taboola, Outbrain, and more Advanced ecommerce: Easy Digital Downloads, SureCart, Cartflow, MemberPress, LearnDash, Amelia, WooCommerce Bookings, GiveWP Cart abandonment emails, session recording, heatmaps, cohort analysis, predictive analytics Email marketing sync (Mailchimp, ActiveCampaign, Klaviyo) White label for agencies Priority support with 24-hour response time Compare Plans Integrations eCommerce: WooCommerce, FluentCart, Easy Digital Downloads (Pro), SureCart (Pro), Cartflow (Pro), MemberPress (Pro) Forms: Contact Form 7, Gravity Forms, WPForms, Fluent Forms, Elementor Forms Builders: Elementor, Divi, Beaver Builder, Gutenberg, WPBakery, Oxygen, Bricks Ad Platforms: Meta (Facebook/Instagram), Google Analytics 4, Google Ads (Pro), TikTok (Pro), Pinterest (Pro), LinkedIn (Pro), Snapchat (Pro), Microsoft Ads (Pro), Reddit (Pro), Twitter/X (Pro), Taboola (Pro), Outbrain (Pro) Consent: Cookiebot, CookieYes, OneTrust, and custom consent filters For Developers and Advanced Marketers TrackSure exposes JavaScript and PHP APIs for custom event tracking, plus WordPress hooks for extending every part of the tracking pipeline. JavaScript API — available on every frontend page via window.TrackSure: window.TrackSure.track(‘button_click’, { button_name: ‘Download PDF’ }); PHP API — record server-side events from form handlers, webhooks, or cron jobs: tracksure()->core->get_service(‘event_recorder’)->record([…]); WordPress Hooks: – tracksure_filter_event_data — modify event data before storage – tracksure_session_started — trigger custom logic on new sessions – tracksure_conversion_recorded — sync conversions to CRM, email, or external systems Full API documentation with code samples: tracksure.cloud/docs Getting Started Install and activate TrackSure Cloud from the WordPress plugin directory Visit TrackSure → Settings to review tracking and privacy options (Optional) Add your Meta Pixel ID + Access Token or GA4 Measurement ID for server-side conversion tracking Go to TrackSure → Overview — analytics data starts appearing after 1 hour External services This plugin connects to external third-party services to provide its functionality. Below is a complete list of all external services used, when they are called, what data is transmitted, and links to their terms of service and privacy policies. When You Enable Meta Pixel / Conversion API: Service: Meta (Facebook) Graph API Purpose: Send conversion events (purchases, add-to-cart, page views) to Facebook for ad optimization What data is sent: Event name, timestamp, hashed user email/phone (if available), product SKU, revenue, IP address, user agent, pixel ID When it’s sent: Automatically when a tracked event occurs (product view, purchase, etc.) and Meta destination is enabled in settings Service provider: Meta Platforms, Inc. Terms of Service: https://www.facebook.com/legal/terms Privacy Policy: https://www.facebook.com/privacy/policy Data Processing Agreement: https://www.facebook.com/legal/terms/dataprocessing When You Enable Google Analytics 4: Service: Google Analytics 4 Measurement Protocol Purpose: Send analytics events to Google Analytics for website traffic analysis What data is sent: Event name, page URL, referrer, session ID, client ID, IP address, user agent, device information When it’s sent: Automatically when page views or custom events occur and GA4 destination is enabled in settings Service provider: Google LLC Terms of Service: https://marketingplatform.google.com/about/analytics/terms/us/ Privacy Policy: https://policies.google.com/privacy When Loading Google Tag Manager Script (If Enabled): Service: Google Tag Manager CDN Purpose: Load gtag.js library for browser-side Google Analytics tracking What data is sent: Standard HTTP request data (IP address, user agent, referrer) when loading the script When it’s sent: On every page load when GA4 browser tracking is enabled Service provider: Google LLC Script URL: https://www.googletagmanager.com/gtag/js Terms of Service: https://marketingplatform.google.com/about/analytics/terms/us/ Privacy Policy: https://policies.google.com/privacy When Loading Facebook Pixel Script (If Enabled): Service: Facebook Connect CDN Purpose: Load fbevents.js library for browser-side Facebook Pixel tracking What data is sent: Standard HTTP request data (IP address, user agent, referrer) when loading the script When it’s sent: On every page load when Meta Pixel browser tracking is enabled Service provider: Meta Platforms, Inc. Script URL: https://connect.facebook.net/en_US/fbevents.js Terms of Service: https://www.facebook.com/legal/terms Privacy Policy: https://www.facebook.com/privacy/policy Cloudflare IP Detection (Always Active): Service: Cloudflare IP Ranges API Purpose: Fetch current list of Cloudflare proxy IP addresses to accurately detect real visitor IPs behind Cloudflare CDN. A bundled static list is included as fallback. What data is sent: Standard HTTP request headers only (no user data transmitted) When it’s sent: Once per day (cached for 24 hours) to refresh the Cloudflare IP list. The plugin includes a bundled fallback list and works without this request. Service provider: Cloudflare, Inc. API URLs: https://www.cloudflare.com/ips-v4 and https://www.cloudflare.com/ips-v6 Terms of Service: https://www.cloudflare.com/website-terms/ Privacy Policy: https://www.cloudflare.com/privacypolicy/ IP Geolocation (When Tracking Is Enabled): Service: ipapi.co (primary), ip-api.com (secondary fallback), WordPress.com Geo API (tertiary fallback) Purpose: Determine the country, region, and city of visitors based on their IP address for geographic analytics reporting What data is sent: The visitor’s IP address is sent to one of the geolocation providers. No other user data is transmitted. When it’s sent: When a new visitor session is recorded and the IP has not been looked up recently. Results are cached for 24 hours per IP. Service providers and policies: ipapi.co (primary) – https://ipapi.co/privacy/ and https://ipapi.co/terms/ ip-api.com (fallback) – https://ip-api.com/docs/legal WordPress.com Geo API (fallback) – https://automattic.com/privacy/ and https://wordpress.com/tos/ Important Notes: No automatic data sharing: TrackSure does NOT send any data to third-party services unless you explicitly enable and configure them in TrackSure Settings → Destinations. Consent-aware: If you use a cookie consent plugin (Cookiebot, CookieYes, etc.), TrackSure will respect user consent choices and only fire pixels after consent is granted. First-party analytics: TrackSure’s core analytics features store all data in your WordPress database. No external services are used for analytics unless you enable Google Analytics 4 or other destinations. You control the data: You choose which platforms to enable, what events to track, and what user data to include (emails, phones, etc.). For more information about data privacy and compliance, see the Privacy & GDPR Compliance section below. Source Code & Build Instructions The admin interface is built with React 18 and TypeScript, compiled with Webpack 5. The compiled files in admin/dist/ are generated from the source code in admin/src/. Full source code is available on GitHub: https://github.com/tracksure-cloud/tracksure To build from source: Navigate to the admin/ directory Run npm install to install dependencies Run npm run build for a production build, or npm run dev for development mode with watch Build tools used: Node.js (v18+) npm Webpack 5 (config: admin/webpack.config.js) TypeScript 5 (config: admin/tsconfig.json) ts-loader for TypeScript compilation Key source directories: admin/src/ — React/TypeScript source code (pages, components, contexts, hooks) admin/dist/ — Compiled production JavaScript (generated by Webpack) assets/js/ — Frontend tracking scripts (non-compiled, human-readable) includes/ — PHP backend (non-compiled, human-readable) Privacy Policy TrackSure stores the following data in your WordPress database: Tracking Data (90-day retention): – Page URLs visited – Referrer URLs – UTM campaign parameters – Device type (desktop/mobile/tablet) – Browser and OS information (user agent) – IP address (can be anonymized) – Session duration and engagement metrics For E-commerce (if using WooCommerce/FluentCart/EDD/SureCart): – Product views – Cart actions – Order completion (order ID, total, items) – Customer email and phone (hashed when sent to Meta/GA4) External Data Sharing (Optional): TrackSure stores all analytics data locally in your WordPress database. No data is sent to external services unless you enable ad platform integrations. Privacy Controls: – IP Anonymization: Available in Settings → Privacy. Default is off …