Skip to content

Journal

·4 min read

A visitor hash that forgets you at midnight

Unique visitors without cookies means a hash, not an ID. Vector 5 salts per site, rotates at 00:00 UTC, and drops the IP. Tomorrow you are new — even to us.

PrivacyUniques

A black analog clock at midnight beside a small pile of white salt
The salt rotates at 00:00 UTC. Tomorrow you are a new unique.

Cookieless analytics still need a way to say “this many people, not this many pageviews.” The usual shortcuts are fingerprints or a long-lived hash of IP + user agent. The first is a tracker. The second is a durable identifier you can be asked to produce.

visitor hash
visitor_hash = SHA-256(daily_salt || site_id || ip || user_agent)

daily_salt   rotates 00:00 UTC, per site, never logged
ip           used once for the hash and a country lookup, then discarded
user_agent   used for the hash and device / browser / OS parsing

After midnight UTC the salt is gone. The same laptop on the same network is a new unique. That is a product choice, not a limitation we plan to “fix.” It gives accurate daily uniques and makes cross-day, cross-device, and cross-site identity impossible — including for the people who operate the server.

  • No cookies, no localStorage IDs, no cookie banner triggered by the script.
  • Country and region from the IP, then the IP is dropped.
  • Crawler hits never receive a person-shaped visitor hash.
A unique visitor is a count for one UTC day. It is not a person you can look up tomorrow.