Skip to main content

Cookie-less Tracking

By default, Ovyxa uses minimal first-party cookies (ovyxa_vid and ovyxa_sid) for accurate visitor and session tracking. Cookieless mode is available as an opt-in alternative by adding the data-cookieless attribute to your script tag. In cookieless mode, no cookies are stored on your visitors' browsers, providing additional privacy benefits while maintaining useful analytics.

Most analytics tools (like Google Analytics) work like this:

  1. Visitor arrives on your website
  2. Analytics script sets a cookie with a unique ID
  3. Cookie persists for months or years
  4. User is tracked across pages and days
  5. Unique visitor count is 100% accurate

Problems:

  • Requires cookie consent banners (GDPR)
  • Privacy concerns (long-term tracking)
  • Cookies can be blocked or deleted
  • Not privacy-friendly

Ovyxa works differently:

  1. Visitor arrives on your website
  2. Analytics script collects: URL, referrer, user-agent, IP address
  3. Server derives: country code, browser type, device type
  4. For unique visitor estimation: creates a temporary hash using:
    • Truncated IP address
    • User-agent family
    • Date (rotates daily)
    • Site-specific salt
  5. Hash used only in memory for deduplication within 24 hours
  6. Hash never stored to disk
  7. Hash expires after 24 hours

Benefits:

  • No consent banner needed (most jurisdictions)
  • Privacy-friendly (no long-term tracking)
  • GDPR/CNIL compliant
  • Can't track individuals across days

Technical Implementation​

Daily Unique Visitor Calculation​

We estimate unique visitors using a transient hash:

// Pseudocode (server-side)
function estimateUniqueVisitor(request, siteId, date) {
  const truncatedIP = truncateIP(request.ip); // e.g., 192.168.1.0
  const uaFamily = parseUserAgent(request.headers['user-agent']).family;
  const salt = getDailySalt(siteId, date); // rotates daily

  const hash = sha256(`${truncatedIP}:${uaFamily}:${date}:${salt}`);

  // Store in memory cache only (Redis, 24h TTL)
  if (!memoryCache.has(hash)) {
    memoryCache.set(hash, true, ttl: '24h');
    return true; // New unique visitor today
  }

  return false; // Already counted today
}

Key points:

  • Hash is never written to database
  • Hash is site-specific (can't correlate across sites)
  • Hash rotates daily (can't track across days)
  • Hash uses truncated IP (not full IP)
  • Hash expires after 24 hours

What Gets Stored​

Only aggregated, anonymized data:

-- What we store in ClickHouse
INSERT INTO events (
  site_id,          -- 'example-com'
  ts,               -- '2025-11-13 14:30:00'
  pathname,         -- '/blog/privacy-analytics'
  referrer_class,   -- 'search'
  country,          -- 'FR'
  browser,          -- 'Chrome'
  device,           -- 'Desktop'
  event_name        -- 'pageview'
);

-- What we DON'T store
-- ❌ IP address
-- ❌ Full user-agent string
-- ❌ Visitor ID
-- ❌ Cookie value
-- ❌ Hash value

Accuracy Comparison​

  • Unique visitors: 100% accurate (persistent ID)
  • Can track: Returning visitors, session duration, user journeys
  • Drawback: Requires consent, privacy concerns
  • Unique visitors: ~95% accurate (daily estimation)
  • Can track: Daily uniques, pageviews, sources, conversions
  • Benefit: No consent needed, privacy-first

Why Not 100% Accurate?​

Cookie-less tracking has small accuracy trade-offs:

  1. Dynamic IPs: If a visitor's IP changes during the day, they may be counted twice
  2. Shared IPs: Multiple people behind the same NAT may be undercounted
  3. VPNs: Users switching VPN servers may be counted multiple times

In practice: These edge cases balance out, and accuracy is typically 95%+ for daily metrics.

Unique Visitors Across Time Periods​

Daily Uniques​

  • Highly accurate (~95%)
  • Hash-based deduplication works well within 24 hours

Weekly/Monthly Uniques​

  • Estimated conservatively
  • We sum daily uniques and apply a statistical model
  • May slightly overcount (same person counted on different days)
  • Still useful for trends and comparisons

Example:

Mon: 100 daily uniques
Tue: 120 daily uniques
Wed: 110 daily uniques
...
Total 7-day: ~600 (not 600+ because some visitors return)
Estimated weekly uniques: ~500 (statistical adjustment)

1. Privacy-First​

  • No long-term tracking of individuals
  • No persistent identifiers
  • Can't build user profiles
  • Visitors remain anonymous

In most jurisdictions (EU, US, CA), cookie-less analytics qualifies as exempt from consent requirements:

  • CNIL (France): Exempt if data is minimal and anonymous
  • ICO (UK): No consent needed for analytics cookies if anonymized
  • GDPR (EU): Legitimate interest basis applies

Always consult your legal counsel for your specific situation.

3. Adblocker-Friendly Philosophy​

We respect visitors who use adblockers:

  • Ovyxa doesn't circumvent blockers by default
  • Visitors who block analytics are making a choice
  • We provide proxy options if you want better coverage (see below)

4. Faster Performance​

  • No cookie reads/writes
  • No localStorage access
  • Smaller script size
  • Faster page loads

When You Might Need Cookies​

Cookie-less tracking works for most use cases, but you might want opt-in mode if you need:

  1. Multi-day funnels: Track user journey over several days
  2. Cohort analysis: Segment users by behavior over time
  3. Returning visitor metrics: Precise "new vs returning" stats

For these features, enable Opt-in Mode (Phase 2):

  • Requires explicit visitor consent
  • Stores first-party ID in localStorage
  • More accurate long-term tracking
  • Must display consent banner

Learn more in our advanced tracking guide (coming soon).

Proxy Setup for Better Coverage​

Adblockers may block Ovyxa requests. If you want better coverage while respecting privacy, use a first-party proxy:

This routes analytics through your own domain, reducing blocks while maintaining privacy standards.

FAQ​

Q: Can I track returning visitors? A: In cookie-less mode, not reliably. You can see daily uniques, but not "this person came back 3 days later." Enable opt-in mode for that.

Q: How accurate are the unique visitor counts? A: About 95% accurate for daily metrics. Aggregate metrics (weekly, monthly) use statistical estimation.

Q: Do I need a cookie banner? A: In strict cookie-less mode, no (in most jurisdictions). Always verify with your legal counsel.

Q: What if a visitor uses a VPN? A: They may be counted multiple times if they switch servers. This is intentional—privacy over perfect accuracy.

Q: Can I switch to cookie-based tracking later? A: Yes, you can enable opt-in mode in your site settings. You'll need to implement a consent banner.

Q: How is this different from Plausible/Fathom? A: Very similar approach. We all use cookie-less tracking with IP-based daily estimation. Minor implementation differences.

Learn More​

Cookie-less tracking is the foundation of privacy-first analytics. It's not perfect, but it's honest, ethical, and respects your visitors.