How this website counts visits without cookies

This website counts visits and clicks without cookies, without storing IP addresses, and without sending anything to an analytics company. It took a small amount of code, and we think more sites should do it.

What we wanted to know

Which pages people read, which buttons they press, and roughly where they came from. That is all. We did not want to know who anyone is.

How it works

When a page loads, the site sends one small message to our own server: the page address, the site you came from (its domain only), and nothing else from your browser. When you press a link or a button, it sends the label of what you pressed. Anything typed into the waitlist form is never included.

To count visitors without recognising anyone, the server makes a visitor code. It mixes your IP address and browser type with a random value, and runs the result through a one-way hash. The random value is replaced every day and deleted after two days. So the code cannot be turned back into an IP address, and yesterday's code cannot be matched to today's. The IP address itself is never stored.

Three more rules:

• If your browser sends a Global Privacy Control or Do Not Track signal, nothing is recorded at all.
• Known bots are left out.
• Events are deleted after 400 days.

What we gave up

The numbers are less precise than a commercial tracker's. A person who visits on three days counts three times in a weekly total. People in one office with identical browsers can merge into one visitor. Ad blockers may hide some visits. For deciding which pages need work, none of that matters.

Why bother

Because it is the same argument we make about AI. You can get most of the value from data without handing it to someone else, if you are willing to build a little yourself. The general idea is set out in what is data custody in AI and local-first AI explained, and the details of this site's practice are in the privacy notice.