Features · Measure

Cookieless analytics — no banner, no consent, no identifier

No cookie, no localStorage identifier, no fingerprint. The visitor id is a hash of a daily secret salt, the site, a normalised IP and the user agent — it becomes a different value tomorrow, so there is nothing to consent to.

Start free Privacy mode docs

The salt rotates every day

Cross-day tracking of an anonymous visitor is not merely disallowed by policy, it is mathematically impossible. That is a real constraint and we accept its cost.

The IP is never stored

It is an input to a one-way hash and nothing else. IPv6 addresses are reduced to their /64 network prefix, which is both more stable and less identifying than the full address.

Do Not Track is respected by default

Not as an option you have to find. In strict privacy mode the DNT override cannot be switched off at all.

Mask what should never be measured

data-mask-patterns rewrites identifying path segments in the browser, before anything is sent. /invoice/8841/pdf becomes /invoice/*/pdf at the source.

The evidence

How the visitor id is built

visitorId = sha256(
  secret_salt + "|" + day + "|" +
  site_id + "|" + normalised_ip + "|" + user_agent
).slice(0, 32)

Change the day and you get a different person as far as the database is concerned. This is why the retention page tells you what it cannot measure instead of guessing.

What this does not do

A cookie-free identity is an estimate, not a census. Someone switching from mobile data to wifi counts twice, and a whole office behind one NAT on the same browser version can count once. Every cookieless tool has this property; we would rather write it down than imply a precision we do not have.