Why unified tracking matters
Most businesses track customer data in silos:- Website analytics shows anonymous pageviews
- Product analytics shows authenticated user behavior
- Billing shows payment events
How the pieces fit together
What happens when a visitor lands on your site?
When someone visits your website, Outlit immediately begins tracking:- Generates a visitor ID - A unique identifier stored in localStorage and cookies that persists across sessions
- Captures behavior automatically:
- Pageviews (URL, title, referrer)
- Form submissions (with sensitive field sanitization)
- UTM parameters and first-touch attribution
- Engagement time (active time on each page)
- Stores events linked to the anonymous visitor ID
How does Outlit connect anonymous visitors to known users?
When a visitor identifies themselves—through signup, login, or submitting a form with their email—Outlit resolves their identity:- Creates or finds a contact using the email or user ID provided
- Links the anonymous visitor to that contact
- Converts historical events into the customer timeline
- Merges profiles if the same person used different devices or browsers
identify() in your code.
For a deep dive into how identity resolution works, including handling multiple devices and profile merging, see Identity Resolution.
What about server-side tracking?
For backend events where users are already authenticated:- Skip the anonymous phase - Users are already known to your system
- Emit events directly to the contact using their email or user ID
- Every call requires identity - No anonymous server events
- Subscription lifecycle events (trial started, payment received, churned)
- Backend actions (report generated, export completed)
- Events from systems without browser access
See Server-Side Tracking for implementation details and SDK options.
Privacy and security
Form Sanitization
Sensitive fields (password, SSN, credit card) are automatically stripped from form submissions.
Domain Allowlist
Configure which domains can send events to prevent unauthorized tracking.
No PII in URLs
Query parameters with sensitive patterns are automatically redacted.
GDPR Ready
Built-in support for data deletion and export requests.