Skip to content

Privacy & data

Measure the site, not the person.

Flatlytics is built to count visits without building a profile of the people behind them. No cookies, no cross-site identifier, and no raw IP addresses in the database.

IP addressUser agentDaily salthash( )SHA-256, salteda3f9c1e8…today's visitor idraw IP never stored

No cookies. Nothing stored on the visitor's device.

The tracker sets no cookies and writes nothing to localStorage. There is no identifier that follows a person from one site to another, because none is ever created.

  • No cookies and no localStorage, so no consent banner you didn't need.
  • No cross-site identifier, ever.
  • The script is under 3 KB and has no third-party calls.

A visitor hash that rotates every day.

To count unique visitors, we hash the IP, the user agent, and a salt that rotates every day. The raw IP is used for that hash and discarded immediately. Yesterday's hashes can't be linked to today's.

  • Raw IPs never touch the database and never appear in an export.
  • Because the salt rotates daily, there's no long-lived identity to leak or subpoena.
  • A practical caveat: unique visitors are per-day by design, someone who visits on two days counts on each.

On principle

What we deliberately don't do.

No fingerprinting

We don't stitch together device signals to re-identify someone across the daily rotation. The rotation is the point.

Geography, not addresses

Country, continent and network are derived at the edge from the request, then the address that produced them is dropped.

Your data stays yours

Export it in full whenever you want. If you leave, we delete it. There's no visitor profile to hand to anyone.

The precise, field-by-field breakdown lives on the data policy and the plain-language summary on the privacy page.

Analytics that respect your visitors.

Get the numbers you need without the profile you don't. Start on the free tier.