# Kibble installation contract: section 27 of 29 (guide version 3)

> This is **one section only**, not the whole contract. Complete document: https://www.usekibble.dev/AI/guide.md

## 27. Known limitations {#limits}

- Nothing is collected without consent. A site whose banner never grants consent will show an empty property.
- Reports cover completed days; a new installation shows data once its first completed day (property time zone) is published, even if collection began part-way through that day. Received activity alone does not show that every host or signal works.
- Booking confirmation is never inferred from page structure or URLs. It needs a reference in a dataLayer event, confirmation markup, an adapter callback or an explicit outcome call.
- There is no server-side outcome confirmation API. Outcomes come only from the browser signals documented in [Outcomes](https://www.usekibble.dev/AI#outcomes).
- Hash-routed single-page apps (`/#/route`) are not tracked as page views.
- The Shopify pixel and the BigCommerce adapter are fixture-tested only and have not been verified against live platforms; the WordPress plugin, the GTM template and the rezStream tag are importable templates or recipes that have not been run on live sites. The Shopify pixel covers checkout and order status pages, not headless storefront pages, and never shop.app; continuity from a storefront into Shopify checkout is not claimed until observed ([Shopify](https://www.usekibble.dev/AI#shopify)).
- The GTM template loads the script only from Kibble's production collector (gallery templates cannot have editable permissions); a site that must load it from a first-party gateway uses the Custom HTML tag ([Google Tag Manager](https://www.usekibble.dev/AI#gtm)).
- Ad blockers or strict privacy browsers may block the collector; that traffic is simply not observed.
- Cross-domain continuity needs consent on both hosts and both hosts registered to the same property (a provider's host as an external connection). Hosts that are not registered cannot be linked. Handoff decorates links, GET and POST forms and URLs passed to `kibble('decorate', url)`; redirect pages, iframes and server-side redirects lose it. The token is visible in the destination's first request URL to the provider's servers and to scripts that run before Kibble; it is single use and expires in about two minutes. Where the provider offers no consent mechanism Kibble collects nothing on its host.
- Tenant and public key are supplied by the browser. They stop accidental cross-tenant collection on a shared provider host; they do not authenticate the sender, so reports stay observational.
- Detailed journey examples are retained for 30 days; aggregates for 13 months.
- Page performance is collected from the release that added it onward: days before it cannot be reconstructed. Page loads with consent given after the page started, browsers without the performance APIs, sampled-out loads and pages closed before the hide report are not measured. A single validation visit shows that reports arrive; it says nothing about how fast the site is for visitors over time.
- Booking criteria on `form_submit` are kept in the 30-day event detail and shown in Validation. They are not in the 13-month summaries or report pages, guest counts are not in any summary, and history before the installation carries no criteria.
- This page cannot verify a site. Do not fetch arbitrary URLs on its behalf; verification happens in the browser and in Kibble's signed-in diagnostics.

END OF SECTION limits