What it sends to each platform
When a platform is on and the visitor has consented, your server sends that platform’s conversion API the event data: the event name, the order value and currency, product identifiers, the page address, and customer identifiers. Email, phone, name and address are normalised the way each platform expects (phone numbers with their country code, cities and postcodes tidied) and SHA-256 hashed before they leave your server. The visitor’s IP address, browser user agent and ad-click IDs are sent as they are, as the platforms require. Nothing goes to a platform you haven’t turned on.
| Platform | Server endpoint |
|---|---|
| Meta Conversions API | graph.facebook.com |
| Google Analytics Measurement Protocol | google-analytics.com |
| X Conversion API | ads-api.x.com |
| TikTok Events API | business-api.tiktok.com |
| Pinterest API for Conversions | api.pinterest.com |
| Snapchat Conversions API | tr.snapchat.com |
| LinkedIn Conversions API | api.linkedin.com |
| Microsoft Advertising Conversions API | capi.uet.microsoft.com |
| Reddit Conversions API | ads-api.reddit.com |
Once you enter a license key, your server also contacts store.zealden.com about twice a day, with the key, your site’s address, a random site ID, the plugin’s main file name and your WordPress, PHP and plugin versions. It never sends visitor data.
Each platform’s browser tag also loads the platform’s own script from its CDN (connect.facebook.net and googletagmanager.com, for example) in the visitor’s browser, subject to your consent settings.
Google Ads enhanced conversions, when you turn them on, send the buyer’s hashed email and phone with the purchase conversion. They’re held back while a visitor refuses marketing cookies.
What stays on your site
Section titled “What stays on your site”- Access tokens are encrypted at rest and never shown by the settings screen or its REST API.
- The Activity log keeps the last 100 server sends: the platform, the event, its value, currency and order number, and the platform’s answer. Clear log empties it.
- Cookies: ad-click IDs are kept in first-party cookies for 90 days, and
ztta_qholds events for up to 5 minutes while a page changes. - For your own privacy policy, Track Them All adds suggested text under Settings › Privacy › Policy Guide.
You’re the controller of this data. Each platform’s terms and privacy policy apply; they’re linked from the plugin’s readme.
Checked against Track Them All 1.0.5 on main, 19 October 2026.