How we handle visitor data
Tinylytics counts visits without cookies, without fingerprinting, and without keeping a visitor’s IP address on the record. We keep what you need in order to read your traffic, and we do not keep a person. This page follows a single page view all the way through so you can check that claim rather than take it.
The script loads
The embed is a small JavaScript file served from tinylytics.app, with Cloudflare in front of it. A visitor to your site receives no Tinylytics cookie of any kind. Whether you still want a banner is your call, but nothing we do requires one.
When the script runs, it sends us:
- the page URL and path
- the referrer, if the browser provided one
- the user agent
The browser also reveals an IP address to our infrastructure, as every HTTP request must. We use it for two things — building a hash and looking up a country — and then it is gone. It is never written onto the hit.
Before anything is stored
Several things get dropped before storage rather than after. Bots, prerender requests, and blank user agents are discarded. Any single source sending more than 25 hits a minute is rate-limited. Recognisable spam is ignored, and repeated bursts from the same hash are suppressed, so a stuck browser tab or an enthusiastic scraper cannot become your traffic.
If you have visited your own site with ?tiny_ignore=true, that browser carries a local storage flag and we never record the request at all. See ignoring your hits.
Unique hits, without a person
Total hits count every load. Unique hits try not to count the same browser twice in a day — and we do that without ever storing a visitor ID, because we never create one.
Each request produces a one-way SHA-256 hash of:
- the visitor’s IP address
- your site’s identifier
- the first 51 characters of the user agent
- today’s date, in UTC
- a salt that rotates every 12 hours
That is the visitor hash. One person reading several pages is one visitor for the day, which is what makes sessions and journeys possible.
The unique hash is the same mixture with the path added, and it produces the per-page unique count you see on a path row.
Neither hash can be reversed. The date component changes at midnight UTC, so tomorrow is a new hash for the same person, and the salt changes twice a day, which leaves a very short window in which guessing would even be theoretically useful. Two browsers produce two hashes. A shared office connection can collapse several people into one. That is the trade we have chosen deliberately: approximate unique hits, and no durable record of a reader.
What a hit looks like
Once the hashes are built, the stored record is roughly this shape:
- the site
- the path and URL
- the referrer, and a UTM-style source when one is present
- the country, as a two-letter code
- a truncated user agent
- the two hashes
- timestamps
No IP address. No name. No cookie. No cross-site identifier. The country came from the IP address, and the address was discarded immediately afterwards.
User agents are cleared from hits older than four weeks, because by then they have told you everything they are going to. Server logs are filtered and deleted after 7 days, and do not retain client IPs unless someone is actively trying to route around Cloudflare.
Country, and only country
Country means country. Not city, not region, not coordinates. The lookup happens, the two-letter code is stored, and the address is gone.
If you send hits through the API with an ip_address, we try a local lookup first and only fall back to IPinfo when that cannot resolve. Either way, the address is not stored.
What you see in the dashboard
Overview, paths, referrers, countries, browsers, and platforms, plus unique hits if you have enabled them. Sessions and journeys are that day’s visitor hash, not a customer you can follow into next week — which is a real limitation, and the correct one for this kind of product.
Optional Insights send aggregated counts — traffic, paths, referrers — to an AI provider. It is opt-in, it is not used for training, and the payload contains no IP addresses, no hashes, and no user agents.
Your account
You, being signed in, get one session cookie. That is for you and has nothing to do with your visitors. Export or delete your account whenever you want, without asking us. Accounts that are never confirmed are removed after 7 days.
The application runs in Falkenstein, Germany, on Hetzner — see hosted in Europe.
Payments run through Stripe, including Stripe Link, and some longer-standing accounts still go through Paddle or Lemon Squeezy. Application errors go to Sentry with a customer id attached, never a visitor. Uptime checks send your site’s URL to Thunder Clap, and nothing about a person.
The privacy policy has the formal version. If something here is unclear or you need an answer for a client, email [email protected].