[Privacy] Add an option not to persist *anything* outside of session

[pcorpet]

Summary

For privacy reasons we'd love to use Amplitude without using any cookies nor local storage.

Motivations

Due to the "Cookie Law" in Europe, a web site or page needs a "cookie approval" before storing anything in a cookie or in a local storage. However it's OK to still log, using amplitude, events and information relative to the website as long as everything stays in RAM. This could be used for the landing page to compute direct conversion even for users who don't approve the use of cookies or local storage.

In terms of implementation, I could provide a PR, if you're OK with the idea: the current implementation already works without using the storage, the storage is only useful when the page is refreshed.

For the moment the way we handle it is to use the disableCookies option and clear the local cache on the callback of every logEvent, however this is suboptimal as some data is still stored and could be kept if the user closes the page before Amplitude server's response. It's also suboptimal because we're basically undoing what the library does, so it would be cleaner not to do it in the first place.

[jooohhn]

Thanks for bringing this up

To clarify, would the goal be to have sessionStorage as an alternative storage strategy to cookies and local storage?

[pcorpet]

I hadn't even thought about sessionStorage which indeed saves on extra usecase (reloading). Maybe we could have a setting called storage or persistance with the following options:

• cookies (current behavior)
• localStorage (current behavior with disableCookies set)
• sessionStorage
• none (absolutely nothing outside of pure memory).

[jooohhn]

Yes those options look good!