Legal

Privacy Policy

Last updated: July 14, 2026

Otter ("we", "our", or "us") operates the otterab.com website and the Otter platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, and password (hashed). If you sign in with Google, we receive your name, email address, and profile picture from Google. We do not receive or store your Google password.

Usage Data

We collect information about how you use the Otter dashboard, including pages visited, features used, and actions taken. This helps us improve the product.

Visitor Data (Your Website Visitors)

When you install the Otter snippet on your website, our SDK collects the following about your website visitors:

  • A randomly generated visitor ID (stored in a first-party cookie)
  • Page URLs visited, plus referrer, landing page, and UTM campaign parameters
  • Variant assignments for active A/B tests
  • Conversion events you configure (page views, clicks, custom events, revenue)
  • Basic device information (browser, operating system, screen size, language)
  • The visitor's browser user agent string
  • Approximate geographic location (country/region, derived from IP)
  • A device fingerprint — a non-reversible hash derived from browser and device characteristics (including canvas and WebGL rendering output, screen geometry, timezone, and platform). We use it to keep a visitor in the same variant when the cookie is unavailable, so that clearing cookies mid-test does not corrupt your results. See section 9.

What We Do Not Collect

  • We do not store visitor IP addresses in our database. The IP is used transiently while the request is being handled — to derive approximate country/region for geo-targeting and to filter bot traffic — and is shown to you in your own project's live activity feed. It is not written to the visitor record.
  • We do not use third-party tracking cookies on your visitors.
  • We do not sell visitor data, share it between customer accounts, or use it for advertising or profiling.
  • We do not collect personal data from your visitors unless you explicitly send it via the identify SDK method.

2. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain the Otter platform
  • Assign visitors to test variants and track conversions
  • Calculate decision scores for your A/B tests
  • Send you account-related communications (confirmations, billing, security alerts)
  • Improve our product and develop new features
  • Detect and prevent fraud or abuse

3. Google User Data

This section describes exactly what data Otter accesses from Google APIs, how we use it, whether we share it, how we protect it, and how it is retained and deleted. Both Google integrations are optional — Otter works without either.

What Google data we access

Google Sign-In (optional). If you choose to sign in with Google, we receive your name, email address, profile picture, and Google account ID. We do not receive or store your Google password.

Google Analytics 4 (optional, per project). If you connect a GA4 property, Otter requests a single read-only scope, https://www.googleapis.com/auth/analytics.readonly, and uses it to read:

  • The email address of the connected Google account
  • The list of GA4 accounts, properties, and web data streams that account can access — names, IDs, measurement IDs, and stream URLs — so that you can choose which one to connect
  • The names of events recorded in the property you select (from the last 30 days), so you can pick one as a conversion goal
  • Aggregated report and funnel data for the property you select: counts of exposed users and converters per experiment variant, for the date range of your experiment

What we never access. We never request write or delete access to your Google Analytics data. We never read user-level or event-level records — no Google Analytics user IDs, client IDs, device identifiers, or IP addresses. Every figure Otter receives from Google Analytics is an aggregate count.

How we use Google data

  • Sign-in data is used only to create and authenticate your Otter account.
  • Property and data stream names are shown to you so you can select which one to connect.
  • Event names populate the goal picker when you configure an experiment.
  • Aggregated counts are used solely to calculate your experiment results — conversion rates and decision scores — and to display them in your dashboard, in reports, and in any notifications you configure.

We do not use Google user data for advertising or ad targeting, for profiling, for credit or lending decisions, or for resale. We do not use it to develop, improve, or train any AI or machine learning models.

How we share Google data

We do not sell, rent, or trade Google user data, and we do not transfer it to data brokers, advertisers, or any other third party for their own purposes. Google data is transferred only to:

  • Our infrastructure providers, who host the platform on our behalf (AWS, EU-West-1) and are contractually bound to protect it.
  • Destinations you explicitly configure — for example, aggregated experiment results appear in a shared report link, an email report, or a Slack or webhook destination if and only if you set one up.
  • Legal authorities, where required by law or court order.

How we protect Google data

  • Google OAuth access and refresh tokens are encrypted at rest at the application layer (AES-256-GCM), on top of full-disk encryption, and are excluded from all application logs and error reports.
  • All data is encrypted in transit using TLS.
  • Only Owners and Admins of the account that owns a project can connect, view, or disconnect that project's GA4 connection.
  • Infrastructure is hosted on AWS (EU-West-1, Ireland) with restricted administrative access.

Retention and deletion of Google data

  • OAuth tokens are retained only while the connection is active.
  • When you disconnect a GA4 property — or delete the project or your account — Otter calls Google's token revocation endpoint to revoke the grant immediately, and deletes the stored tokens.
  • You can independently revoke Otter's access at any time from your Google account permissions page.
  • Aggregated experiment results already calculated from Google Analytics data (variant-level counts only, containing no Google user data) are kept with your experiment history so your past results remain readable, and are deleted when you delete the experiment or your account.
  • To delete your account and all associated data, email privacy@otterab.com. We action deletion requests within 30 days.

Limited Use

Otter's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Data Sharing

We do not sell, rent, or trade your data or your visitors' data to third parties. We may share data with:

  • Service providers who help us operate the platform (hosting, payment processing, email delivery). These providers are contractually bound to protect your data.
  • Legal authorities if required by law, court order, or to protect our rights.

5. Data Storage and Security

  • All data is encrypted in transit (TLS/HTTPS) and at rest.
  • Passwords are hashed using bcrypt and never stored in plain text.
  • We use database-backed sessions with signed, httponly cookies.
  • Our infrastructure is hosted on AWS (EU-West-1, Ireland).

6. Data Retention

Account data and visitor data are retained for as long as your account is active, so that historical experiment results remain available to you. We do not currently run an automatic time-based purge of completed-test visitor data; scheduled retention limits are on our roadmap and this policy will be updated when they ship.

You can request deletion of your account, a specific project, or an individual visitor's data at any time by contacting privacy@otterab.com, and we will action it. In addition, the SDK deletes a visitor's server-side record automatically when consent is revoked via optimo.grantConsent(false).

7. Your Rights (GDPR)

If you are in the European Economic Area, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Object to or restrict processing of your data
  • Data portability (receive your data in a structured format)
  • Withdraw consent at any time

To exercise these rights, contact us at privacy@otterab.com.

8. Cookies and Local Storage

The Otter dashboard uses a session cookie to keep you signed in. On your visitors' browsers, the A/B testing SDK writes the following — all first-party, on your own domain. There are no third-party cookies.

  • optimo_uuid — cookie, 365 days. A random visitor identifier, used to keep variant assignments consistent.
  • optimo_redirect — cookie, session. Prevents redirect loops on split-URL tests.
  • optimo_consent — localStorage. Records whether consent has been revoked.
  • _optimo_cache, _optimo_variants — localStorage. Cached test configuration and this visitor's variant assignments, so the correct variant renders immediately on repeat visits.
  • optimo_pending_events — sessionStorage. Buffers conversion events that failed to send, so a dropped request is not lost.
  • _optimo_ga4_impressions, optimo_converted_goals, optimo_preview_* — de-duplication and preview state.

These are functional to the operation of an A/B test rather than advertising identifiers, but under the ePrivacy Directive they still constitute storage on terminal equipment. Most consent regimes therefore require you to obtain consent before the SDK runs — see section 10.

9. Device Fingerprinting

We want to be explicit about this rather than bury it. The Otter SDK computes a device fingerprint: it renders text and shapes to an off-screen canvas, reads WebGL vendor and renderer strings, and combines these with screen geometry, device pixel ratio, timezone, platform, language, and CPU core count. The result is hashed into a short non-reversible value and sent to our servers.

What we use it for. Solely to re-identify a returning visitor whoseoptimo_uuid cookie is missing, so that they continue to see the same variant. Without it, a visitor who clears cookies is counted as a new visitor and may be shown a different variant, which both harms their experience and biases your results.

What we do not use it for. We do not use the fingerprint for advertising, cross-site tracking, profiling, or identification across different customers' websites. Fingerprints are scoped to a single project.

What this means for you. Because a fingerprint persists after cookies are deleted, regulators treat it as accessing terminal equipment in its own right, and it generally requires consent on the same footing as a cookie. Treat the Otter SDK as something to gate behind consent, not as an exempt analytics script.

Otter is a processor acting on your instructions; you are the controller for your own visitors, and obtaining a valid legal basis is your responsibility. To support that, the SDK exposes optimo.grantConsent(false). When consent is revoked the SDK stops before it initialises — it assigns no variant, renders no change, writes no cookie, and makes no network request — and it deletes the visitor's existing server-side record, including sessions, assignments, and events.

Current limitation, stated plainly. This is opt-out: absent a stored revocation, the SDK initialises and tracks by default, and it is consulted only at initialisation. If you load the snippet in <head> and your consent banner resolves afterwards, tracking will already have occurred. We do not yet auto-detect IAB TCF, Google Consent Mode, or specific consent platforms. If you need strict prior consent today, load the Otter snippet only after your banner returns a positive signal. A native consent-required mode with CMP detection is in development.

11. Children's Privacy

Otter is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on our website. Your continued use of the service after changes constitutes acceptance.

13. Contact

For privacy-related questions or requests, contact us at privacy@otterab.com.