Settings & Privacy

All of this lives on the Settings tab of the Attribution page, per domain.

Attribution window

How long after a click a purchase can still be credited: 7, 30, 60, 90, 180, or 365 days. 90 days is the default and the recommended setting, UGC driven purchases often land 30 to 90 days after the first click, well past what a normal click report would ever connect.

Attribution model

When more than one click from the same visitor falls inside the window, this decides which one gets the credit:

• Last click, credit the most recent link click. The default, and the right choice for most accounts.

• First click, credit the creator who introduced them, even if a different link was clicked right before the purchase.

• Last non-direct, skip clicks with no source (someone typing your URL in directly) and credit the last campaign link before that.

Cookie lifetime

How long the visitor id is kept in the browser, up to 400 days. Some browsers cap script written cookies at 7 days regardless of this setting, which is exactly why the snippet sets a first party cookie instead whenever your link domain and site domain match, see the Developer Quickstart.

Device matching

A last resort match on device and network within an hour, for the rare case where no cookie or identity is available at all. Reported at low confidence, see the API Reference for how confidence is scored across every match type.

Privacy

• Respect Do Not Track, skip tracking entirely for visitors whose browser sends the DNT header.

• Require consent, store nothing until your cookie banner calls sm.consent('granted').

Allowed origins

A list of origins allowed to send tracking beacons for this domain, one per line, for example https://brand.com or a wildcard subdomain like https://*.brand.com. Leave it empty to accept any origin, which is the default and is safe since the site key itself is what scopes writes to your domain.

Rotating the site key

Your site key is shown at the bottom of this tab. Rotating it stops every existing snippet from reporting until you update the key in the script tag on your site, so only do it if the current key has leaked.

Turning attribution off

The Attribution enabled toggle at the bottom stops new clicks from carrying an attribution id. Nothing already collected is deleted, historical data stays exactly as it is.