On this page
No cookies, no local storage
The website script sets no cookies and uses no localStorage or similar browser storage. By default we leave nothing in a visitor's browser.
So how are visitors told apart?
When a request arrives, the collector derives a visitor identifier from three things: your site, the network address the request came from, and browser details. It mixes in a salt known only to the collector, and the result is a one-way digest (an HMAC), not the IP itself.
The identifier only answers "is this the same person?". It is never linked with data from other websites.
Are IP addresses stored?
No. The network address is used twice at the moment of collection — to derive the visitor identifier and to look up approximate location (country, city) — and then discarded. It's never written into an event.
Before the location lookup you can also shorten the IP so the location found is coarser:
- IPv4: drop the last one or two parts.
- IPv6: keep only the first /64, /56 or /48.
- Not shortened by default. If you've had visitors from the EU or UK in the last 30 days, the privacy center suggests shortening for EU/UK traffic only, set in one click.
You can also limit location to country level, or not record location at all.
Balanced and strict mode
Where: Configuration › Settings › Privacy.
| Balanced (default) | Strict | |
|---|---|---|
| Salt rotation | Kept for a long time per site | Changed daily |
| New vs returning visitors | Yes | No — everyone is new each day |
| Retention, visitor profiles | Available | Not available |
| Good for | Most websites | Very privacy-sensitive cases with no need for return-visit analysis |
Three collection levels
Finer control lives under Configuration › Privacy center, as levels:
| Level | Name | Meaning |
|---|---|---|
| 1 | Anonymous aggregate | The identifier changes daily and nothing persistent is kept. Autocapture and identity operations don't run |
| 2 | Cookieless pseudonymous | Visitors told apart by the digest above; no cookies. Default for new projects |
| 3 | Identified | Device identifiers and sign-in linking allowed. Needs identity mode on the project |
Without identity mode, a project can't go above level 2.
Other protections on by default
- Strings in event properties that look like emails or phone numbers are replaced with a placeholder before storage.
- Autocapture doesn't record text on the page.
- Emails and phone numbers sent at sign-in are kept out of user profiles.
- Data is deleted automatically when its retention period ends.
Do I still need a cookie banner?
In many cases, with only the default cookieless analytics, you don't need a separate consent banner for analytics. But that depends on the law where you operate, the other tools on your site and the features you turn on — identity mode, for instance. This isn't legal advice; check with your legal team. For per-region setup, see Consent rules by region.