Privacy

Krafter Analytics is built with privacy as a core design principle, not an afterthought. No cookies, no fingerprinting, no personal data stored. This page explains exactly how visitor privacy is protected.

No Cookies

Krafter Analytics does not set, read, or require any cookies. There are no first-party cookies, no third-party cookies, and no tracking cookies of any kind. Because no cookies are used, no cookie consent banner is needed.

No Fingerprinting

The tracker does not collect or combine browser attributes for fingerprinting. There is no canvas fingerprinting, no WebGL fingerprinting, no font enumeration, and no audio context fingerprinting.

Visitor Identification

Visitor identification uses a SHA-256 hash of three inputs:

1. The visitor's IP address
2. The visitor's User-Agent string
3. A daily rotating salt generated by the server

visitor_id = SHA-256(ip + user_agent + daily_salt)

INFO

The daily salt rotates at midnight UTC. This means the same visitor gets a new hash every day, making it impossible to track individuals across days. Yesterday's visitor cannot be linked to today's visitor -- and because yesterday's salt is deleted at midnight rather than merely replaced, the link cannot be recomputed afterwards either.

This approach gives same-day unique visitor counts without storing any personally identifiable information (PII).

One salt is stored per UTC day, encrypted at rest, and every server reads that same one. A deploy, a restart or a second server therefore does not change how a visitor hashes: a visitor seen before and after one counts once.

Counts still err upwards, never towards identification

A visitor whose IP or User-Agent changes during the day -- moving from mobile data to Wi-Fi, or a browser updating itself -- hashes differently afterwards and is counted twice. Unique visitor figures are therefore a floor on privacy and a ceiling on accuracy: they can overstate how many distinct people visited, never understate it, and never make a visitor easier to identify.

No PII Stored

The analytics database stores only aggregated and anonymized data:

• No IP addresses
• No User-Agent strings (only parsed device/browser/OS labels)
• No visitor IDs persisted beyond the daily aggregation window
• No email addresses, names, or account identifiers

Data is stored in ClickHouse with privacy-safe aggregation, ensuring that raw visitor data cannot be reconstructed.

Data Retention

Events are not kept forever. Every site has a retention_days setting and a nightly job deletes events older than it; a new site starts at its plan's allowance — 30 days on Free, up to 730 on Scale — and you can set anything shorter from Analytics → Settings or through the Sites API. Under that, the event table carries a hard 2-year TTL, so nothing survives beyond 730 days regardless of configuration.

Do Not Track

Krafter Analytics respects navigator.doNotTrack. If a visitor has enabled the Do Not Track setting in their browser, the tracker script will not collect or send any data. The script checks this setting on every page load.

WARNING

Do Not Track is a browser-level setting. Visitors who enable it will not appear in your analytics at all. This is by design.

No Cross-Site Tracking

Each site key is scoped to a single domain. Visitor hashes are domain-specific, meaning the same visitor on two different sites tracked by Krafter Analytics cannot be correlated across sites.

Bot Detection

The tracker includes built-in bot detection that filters out:

• Common web crawlers and search engine bots
• Monitoring services and uptime checkers
• Headless browsers and automated tools
• Known bot User-Agent patterns

Bot traffic is discarded before it reaches the analytics database, keeping your data clean and accurate.

Host Validation

A site accepts events from any origin until you list hosts under Allowed Hosts in its settings. Once the list is set, the tracking endpoint checks the browser's Origin header against it and drops events from anywhere else, so a third party who copies your site key onto their own page cannot inject data into your analytics. A bare domain covers its subdomains: example.com also accepts app.example.com. Enter hosts without a scheme.

The list is a browser check, not authentication. A page cannot forge Origin — the browser sets it — which is what makes it worth checking. Anything that is not a browser can set it to whatever it likes, so a request that carries no Origin at all is accepted whatever the list says: that is what lets server-side tracking, a mobile app, or an integration proxying events send data. Your site key is public — it sits in your page source — so treat the list as abuse prevention for other web pages, not as a gate.

GDPR Compliance

Krafter Analytics is GDPR compliant by design:

GDPR Requirement	How We Comply
Lawful basis	Legitimate interest -- no PII collected
Data minimization	Only page URL, referrer, screen width, and parsed device info stored
Storage limitation	Per-site retention deletes old events nightly; the daily salt is rotated and the old one deleted, so long-term visitor tracking is not possible
No consent required	No cookies or persistent identifiers used
Right to erasure	No PII exists to erase
Data portability	Aggregate data can be exported via the Stats API

TIP

Because Krafter Analytics does not process personal data as defined by GDPR, you do not need to add it to your privacy policy's cookie section or show a consent dialog. You may still wish to mention its use in your privacy policy for transparency.

Summary

Feature	Status
Cookies	None
Fingerprinting	None
PII storage	None
Cross-site tracking	Not possible
Do Not Track	Respected
Bot filtering	Active
Host validation	Active
GDPR consent needed	No

Next Steps

• Quickstart -- get started with Krafter Analytics
• Tracker reference -- see what data the tracker collects
• Stats API -- query your aggregated analytics data