Signals, not surveillance.
SurgeIndex is designed to measure attention without collecting the contents of people’s work.
What the tracker sends
The browser tracker sends an anonymous event ID, event type, site key, session ID, pathname, referrer host, timestamp, viewport, and locale. It does not collect names, email addresses, form contents, page text, or full IP addresses.
How identifiers are handled
Visitor identifiers are first-party and rotate. The collector hashes IP-derived material with a rotating server-side salt and keeps the raw address out of application tables. Bot and fraud signals are stored as decisions and reason codes, not as a personal profile.
Sponsored delivery and attribution
Boost delivery uses short-lived signed opportunity tokens and an expiring anonymous visitor-context hash for viewability, replay, bot, and frequency controls. Raw IP addresses, card details, Stripe secrets, and attribution secrets are not stored. A paid landing event may be linked to the campaign only when the destination tracker confirms it; paid traffic remains a separate origin from organic referrals.
Your controls
The tracker respects an explicit opt-out and documents the Do Not Track policy. Owners can disconnect GA4, revoke OAuth access, pause or cancel Boost campaigns, and request deletion of their site data. Retention settings are deployment-specific and must be configured before launch.
Important note
This is product documentation for the MVP. Commercial launch requires a professional legal review of the privacy notice, consent requirements, advertising disclosures, retention schedules, payment processor terms, and regional obligations.