# Privacy controls: paths, query parameters and sensitive terms

> Mask sensitive pages, decide which query parameters the tag keeps, apply a platform preset, and get a weekly summary of what Kalman held back.

Updated 2026-11-10 · Privacy and consent · https://kalmananalytics.com/support/privacy-controls/

The Kalman tag never reads form fields, input values, page titles or page text. The controls below narrow what it records even further. Most of them are on the **Privacy review** page in the sidebar. A number next to it means new paths or parameters are waiting for your review.

## 1. Platform

Pick your intake platform. Each preset adds the sensitive path patterns known for that platform on top of Kalman's defaults. If yours isn't listed, choose **Other** to keep the defaults only.

The defaults already cover common sensitive areas, such as `/intake/**`, `/patient/**`, `/checkout/**`, `/questionnaire/**` and `/orders/**`. A visit to a page that matches a pattern is stored as the pattern, never as the real address. **Active patterns** shows every pattern in use.

## 2. Paths seen

This table lists the paths the tag has recorded, with hits and when each was last seen. For each path you can:

- **Mask**: add a pattern (Kalman suggests one, with ids replaced by `*`). From then on, visits store the pattern.
- **Keep**: leave the path as it is.
- **Ignore**: hide the path from the list.

In a pattern, `*` matches one path segment and `**` matches any number of segments, for example `/intake/**`.

## 3. Query parameters dropped

The tag keeps only allowed parameters. These are the `utm_` tags and the ad click ids by default. Everything else is removed before storage. This table shows only the **names** of parameters the tag dropped, never their values.

- **Allow** keeps a parameter's values from now on.
- **Drop** stops it showing in the list.

Parameters whose names suggest personal data, such as email, phone, name or birth date, show **Can carry personal data: always dropped**. They can't be allowed.

## Sensitive terms

Kalman has a built-in list of condition, medication and body terms. Any path segment containing one of those terms is stored as `:masked`. Kalman also uses the list to block custom event names that would name a condition. Short terms are matched as whole words only, so ordinary words aren't caught by mistake.

When you apply suggestions from a website scan during onboarding, the scan can add your own program or product words. They appear as **Brand terms masked too** and are treated like the built-in list.

## More settings on the Tracking page

**Integrations** → **Tracking** → **Privacy settings** has:

- **Allowed origins**: the hostnames that may send events.
- **Sensitive paths** and **Allowed query params**: the same lists as above, as text.
- **Intake domains**: hosts whose links receive Kalman's visitor id (see [click ids and intake links](/support/click-ids-and-intake-links/)).

Click **Save privacy settings** when you're done. You need to be an owner or admin to change any privacy setting.

## Weekly privacy summary

When Kalman held something back that week, workspace owners get an email on Mondays. It covers skipped events by reason, blocked event names, webhook fields whose names look sensitive, and newly masked paths. It contains counts and field names only. If there is nothing to report, no email is sent.

The summary is on by default. Use **Turn off** / **Turn on** on the Privacy review page to change it for the workspace. Each owner can also turn it off for themselves under **Settings** → **Email**.

## What Kalman never sends

Masked paths, dropped parameter values and anything that names a condition, medication or product are never sent to an ad platform.

Still stuck? Log in and open a request: https://app.kalmananalytics.com/support