Privacy
This page describes the product's behaviour. It is not a substitute for your own privacy policy.
What is never stored
IP addresses and user agent strings are inputs to a hash and are discarded immediately after it is computed. Neither is written to any table. There is no cookie, no localStorage entry, and no durable identifier of any kind handed to a visitor.
That is also why sites running it do not carry a cookie banner. Consent notices exist to cover storing or reading something on a visitor's device, and this stores and reads nothing. Whether your site needs one for other reasons is a question for your own counsel.
How a visitor is counted
visitor_id = base64url(sha256(daily_salt || site_id || ip || user_agent))[:22]The salt is per site and rotates every UTC midnight, so the same person is a different visitor id tomorrow. Salts older than the configured retention are deleted. After that deletion a historical visitor id cannot be recomputed even by someone holding the entire database plus a suspect's IP address.
A visit in progress across midnight is stitched into one session by also checking the previous day's salt. That lookback reaches exactly one salt period, and only for a session still inside its timeout. A salt that has already been deleted stays deleted.
What is stored
- The path visited, and the referring host. The full referring URL is not stored.
- Country, derived from the IP before it is discarded. Never city.
- Browser, OS and device class, approximated from the user agent. Anything the parser does not recognise is reported as Unknown.
- UTM source, medium and campaign when present in the URL.
- Custom event names and any properties you choose to send.
Signals the tracker obeys
Do Not Track and Global Privacy Control both stop it recording. It skips localhost unless explicitly told otherwise, so a development server never pollutes real numbers.
Where the data goes
It stays on one service and one Postgres database, with no third party in the request path. Raw events are kept for a retention period you set per site or per organisation, and deleted once it passes.