How cookieless tracking works
What Linqry stores, what it never stores, how visitors are counted, and why there is no cookie banner.
The identification model
Linqry never writes cookies and never stores a persistent identifier. A visitor is identified by a server-side hash:
visitor_id = HMAC-SHA256(key = daily_salt, ip | user_agent | site_id) // first 128 bits
The salt is random and rotates every UTC day, so the same person produces a different ID tomorrow: there is nothing to recognise them across days, across sites, or to hand to a data broker. Salts older than two days are deleted, so past visitor ids cannot be recomputed even with database access. Sessions are derived from the visitor ID in 30-minute buckets, entirely server-side.
What rotation means for the numbers
Because IDs change daily, visitors in the dashboard means unique visitors per day, summed over the selected range: a person who visits on three different days counts three times. Funnels and visitor timelines likewise cover activity within a day. This is the honest cost of having no persistent identifier; tools that report true multi-day uniques do so by setting a cookie or storing a fingerprint.
What is stored per event
| Stored | Not stored |
|---|---|
| Event name, URL/path, external referrer, UTM parameters | Cookies or localStorage identifiers |
| Daily-rotating visitor hash + session bucket | Raw IP addresses: the IP is used in memory for the hash and geo lookup, then discarded. Not stored, not logged. Debug logging (LINQRY_DEBUG_INGEST=1) redacts the last octet. |
| Country, region, city (resolved locally via geoip-lite; no third-party service) | Cross-site profiles or fingerprints |
| Device class, browser, OS (parsed from the user agent) | The full user-agent string |
| Time on page, custom properties, revenue you attach | Anything you don't send |
What this means for consent
There is no tracking cookie to disclose, no cross-site identifier, and no raw IP at rest. For the service, the Privacy Policy lists exactly what we hold and who processes it.
Whether your overall setup needs a privacy-policy mention or consent depends on your jurisdiction and on what you send in custom properties. Don’t put personal data in them. This page describes how the system works; it isn’t legal advice.
Opting out
Requests from crawlers, headless browsers and HTTP clients are dropped on the server. Any visitor can exclude themselves per browser:
localStorage.setItem('linqry_ignore', 'true')