What never goes in an event

Send facts about the action, not about the person

Good event properties are booleans, counts, bucketed lengths and values from a fixed list:

analytics.track('message_sent', {
  has_attachment: true,
  recipients: 3,
  length_bucket: '100-500',
  channel: 'email',
});

Never put these in an event property: an email address, a name, a phone number, an address, or any text a person typed — a search query, a message, a form field.

Where identifying facts go instead

On the person, not the event. Pass your user id to identify(), and put traits such as an email or a plan on the profile with setPersonProperties() (Set person properties). A person’s profile is one record, so erasing somebody is a targeted delete. The same email in event properties would be in every file they ever appeared in.

What Togo catches, and what it cannot

• Property values are primitives only — strings, numbers, booleans, null — with no nesting, at most 1,024 characters a value and 256 properties an event.
• With Drop email addresses from event properties turned on (project Settings → Event governance, or update_project with piiFilterEnabled), a property whose key or value contains an email address is dropped before it is stored. It is off by default: properties are stored as sent, and turning it on does not remove what is already stored.
• The browser SDK replaces an email address in a page path, referrer or campaign value with REDACTED_EMAIL, and never sends the query string or the #fragment.
• While you test with a test key, the diagnostics on each event warn you when a property, a userId or a session id looks like an email address, so your agent can take it out before you ship.

Nothing can recognise every kind of personal data — a phone number or a name in a free-text property is not detected. Keeping it out is yours to do, as a term of use: Togo does not ask for it and does not promise that none ever arrives.

Consent is separate

Whether you may collect analytics from a visitor at all is a consent question for your site, and the browser SDK gives you the switch: Connect a consent banner.