Keep licence keys and emails out of your analytics

After a payment, our provider sends the buyer back to /order/complete with the payment id, the status, the buyer's email and their licence key in the URL. That is useful: it is how the page can show the key. It is also exactly the URL that analytics records on every page view.

Where it leaks

• Google Analytics records page_location as the full URL, query string included.
• A hand-rolled Mixpanel call often sends $current_url as location.href.
• The browser keeps it in history, and it appears in any screenshot of the address bar.

The fix, in three places

// 1. GA: set page_location before config on sensitive paths
var loc = location.pathname.indexOf("/order/") === 0
  ? location.origin + location.pathname : location.href;
gtag("config", id, { page_location: loc });

// 2. Your own events: same rule for $current_url
// 3. The page: read the params, then wipe them
history.replaceState(null, "", location.pathname);

Scope it to the paths that carry private data rather than stripping every query string, or you lose UTM parameters that tell you which campaign brought someone.

Test it the boring way

Load the return page with a fake key, then open your analytics real-time view and the browser history, and search for the fake key. It should be in neither. The broader tracking setup this sits inside is in an event plan for a landing page.