What Luria stores
The events Luria records on your site, what it never records, the Shopify data it syncs, where it all lives and how long it is kept.
Luria's events are content-free by design. They record that something happened, and on which page, never what a person typed, bought, or is called.
What you'll need
Nothing. This page is a reference; none of it is configurable.
What the snippet records
Every event carries a random visitor id, a timestamp and the page path. Then, per type:
| Event | What it carries |
|---|---|
session_start | device type (mobile or desktop), the referring URL, and utm_source / utm_medium / utm_campaign if present |
pageview | the page path |
click | the visible label of the link or button clicked, first 60 characters |
form | that a form was started. Never the field contents |
checkout_step | the path, on pages that look like checkout or payment |
exposure | which test the visitor saw, and which arm |
conversion | the goal name and the value passed with it |
Events are batched and sent every 1.5 seconds, and again when the page is hidden.
What Luria never records
- Names, email addresses, phone numbers, postal addresses.
- Passwords, payment details, or anything typed into a form.
- Device fingerprints. No canvas, audio or device-entropy signals, ever.
- Precise location.
Visitor ids
A random id, generated in the visitor's own browser and kept in localStorage as luria_sid. It is first-party to your domain, it is not derived from anything about the person, and it is never matched to a visitor on another merchant's site.
What you give Luria directly
Your email, your store URL, your onboarding answers, and the scan of your own public pages (page content plus screenshots of pages that were publicly reachable). That is data Luria controls, rather than data Luria processes on your behalf.
What Shopify syncs
Once the app is installed and the terms approved, Luria keeps copies of the store objects it needs to measure conversions honestly: orders, refunds and returns; products and inventory; customers; fulfillments; abandoned checkouts; price rules and discounts; marketing events; locations and shipping; page content and locales; and the customer events that power the web pixel. Orders are what make a conversion trustworthy, which is why they are synced rather than inferred.
You can export or delete every one of those copies yourself. See Deletion and the DPA.
How long it is kept
| Data | Kept for |
|---|---|
| Raw visitor events | About 90 days, then deleted automatically by a daily job |
| Aggregated statistics | Indefinitely. They identify nobody |
| Lead and account records | While your account is active, then up to 24 months |
| Server logs | About 30 days |
| Anything, on request | Deleted within 30 days |
Where it lives
Hosting and server logs run on Vercel (United States). The database is Supabase Postgres (United States). Scan workers that open your public pages run on Hetzner (European Union). Page content goes to Anthropic (United States) for analysis and copy generation, and is not used to train their models. Cloudflare runs the Turnstile check on public forms, Shopify holds the store data you authorize, and Resend sends transactional email.
Luria is based in the United States, and relies on Standard Contractual Clauses for UK and EEA transfers.
Cross-store learning
Luria learns aggregate patterns across stores, for example which kind of headline tends to win in a niche. It never builds a profile of an individual visitor across merchants, and visitor data is partitioned per site in the database.
Verify it worked
Export everything from the Luria app in your Shopify admin and open the JSON file. What is in that file is what Luria holds for your store.
Common failures
- You expected customer names. Sessions carry no name. The dashboard's Customers table identifies a converted session by the first characters of its random id, with the traffic source beside it.
- The events look thin. They are meant to. Content-free is the design, not a gap.
- Data older than 90 days is missing. Raw events age out. Change history and the aggregate counters stay.
- You want a specific visitor erased. Email privacy@luriart.com; see Deletion and the DPA.