Heap

Overview

Heap is a product analytics platform that automatically captures every user interaction on a website or web application without requiring manual event instrumentation. Unlike traditional analytics tools where engineers must code each tracked event in advance, Heap's auto-capture approach records all clicks, form submissions, page views, and UI interactions from the moment the script loads. Product and growth teams use Heap for retroactive funnel analysis, user journey mapping, cohort retention analysis, and feature adoption measurement. Heap also offers session replay capabilities when that feature is enabled.

What This Script Does

The Heap script (cdn.heapanalytics.com/js/heap-[APP_ID].js) initializes the Heap SDK and begins comprehensive event capture immediately:

Auto-capture behavior:

• Captures every click interaction, including the target element's CSS selector path, text content, element attributes (aria-label, data-* attributes, id, class), and coordinates
• Records all form field interactions — focus, blur, and change events — along with field metadata. Note: Heap masks input values by default to avoid capturing passwords and sensitive data, but this is configurable.
• Tracks page views (URL, referrer, page title) on every navigation and route change in single-page applications
• Captures rage clicks, dead clicks, and scroll depth when session replay is enabled

Cookies and identity:

• Sets _hp2_id.[APP_ID] (first-party, persistent, 13-month expiry) — the primary user identity cookie storing a pseudonymous Heap user ID
• Sets _hp2_ses_props.[APP_ID] (first-party, session, expires at session end) — current session metadata including session start time and initial referrer
• Sets _hp2_hld.[APP_ID] (first-party, 1-day expiry) — used for holdout experiment group assignment

Data transmission:

• Batches captured events and sends them via POST to heapanalytics.com/api/track at regular intervals and on page unload
• Each event payload includes: user ID from cookie, session ID, event type, timestamp, element metadata, and page URL

Session replay (if enabled):

• Records DOM snapshots and mutation events to reconstruct user sessions
• Captures mouse movements, scroll positions, and viewport dimensions
• Replay data is transmitted to Heap's servers separately from event data

Retroactive analysis:

• Heap's data model stores raw event streams, allowing teams to define virtual events (e.g., "clicked Add to Cart") after the fact and apply them to historical data

Consent & Compliance

• Category: Analytics
• GDPR/ePrivacy: Heap captures extensive behavioral data and sets persistent cookies for user identification across sessions. The auto-capture model means data collection is broad and continuous. Explicit consent is required under the ePrivacy Directive before the script loads. A data processing agreement with Heap is required. Heap offers EU data residency options.
• CCPA: Behavioral event data, session data, and the pseudonymous user ID constitutes personal information. Must be disclosed in your privacy policy. Honor opt-out requests by blocking the script.
• Session replay: If session replay is enabled, the privacy implications are heightened — DOM snapshots may capture sensitive content visible to users. Additional notice to users is advisable.
• EU-US transfers: Heap is US-based (San Francisco). Transfers rely on Standard Contractual Clauses or the EU-US Data Privacy Framework.

Should You Block This Without Consent?

Yes. Heap's auto-capture approach records all user interactions and sets persistent identifying cookies from the moment it loads. Its broad-by-default data collection model makes prior consent especially important — there is no "minimal" version of Heap that loads without tracking. Block until analytics consent is granted.