No cookies, ever
The visitor tracker sets no cookies and uses no localStorage or sessionStorage. This describes the analytics tracker; the account dashboard uses browser storage for authentication and preferences.
Appearance
ProductPrivacy & GDPREvery feature on every plan.
Privacy-first web analytics without cookies
A tracker with no cookies or local storage, site-scoped visitor pseudonyms and EU-hosted analytics. Understand what we process, what we retain and which privacy decisions remain yours.
Illustration of the platform's privacy approach
A closer look at the platform.Sample data
ZeroCookies set
24hDaily visitor hash rotation
CountryMax geo precision
4Bot detection levels
Capabilities
Privacy, built into the details.
No visitor IP address storage
IP addresses are used at the moment of ingestion for country-level geolocation (a country-level GeoIP database, 2-letter ISO code), for the daily visitor hash and the 90-day funnel pseudonym described below, for rate limiting and for your IP exclusion rules. The raw visitor IP is never written to the analytics database and is discarded after processing.
Daily rotating visitor hash
The server derives a visitor hash from the domain, IP, User-Agent and a daily random salt. The salt rotates daily and expires within 48 hours. Daily hashes are still kept in the event log for 12 months, alongside a separate funnel pseudonym.
A separate rotating funnel pseudonym
Funnels use a second site-scoped HMAC derived from the IP, User-Agent and a fixed 90-day window. It is retained in the raw event log for 12 months. This is pseudonymous data; rotation does not make every stored record anonymous, and changes in IP or browser can split a journey.
Country-level geolocation only
Analytics resolves location to a 2-letter country code, rather than storing a city, postal address or GPS position. A coarse location reduces detail but does not by itself make a record anonymous.
4-level bot detection
Scores range from 0 to 3 using known bot User-Agents, the Accept-Language header and a client interaction signal. These are heuristics, with possible false positives and false negatives, rather than proof that a visitor is human.
No cross-domain tracking
Each site is isolated. Both the daily hash and the funnel pseudonym are scoped to one site, so a visitor on site-a.com and site-b.com produces completely different identifiers even with the same IP and browser. There is no cross-domain user graph.
A closer look
Privacy in every part of the platform.
GDPR compliance
Designed to reduce visitor data collection
Cookie-free measurement and site-scoped pseudonyms reduce reliance on persistent browser identifiers. IP addresses and User-Agents are still processed, and pseudonymous records can remain personal data. You need an appropriate lawful basis, transparent notices and any consent required by your use and jurisdiction.
Privacy architecture
How visitor counting works without cookies
The deferred tracker sends the page URL, referrer, viewport width, an interaction flag and custom event data. It does not probe canvas, installed fonts or device hardware. The server derives a daily visitor hash and a separate rotating funnel pseudonym from the request. Never put personal details in URLs, event names or properties.
Data sovereignty
EU-hosted visitor analytics
Our visitor analytics infrastructure is hosted within the EU. This is separate from account, payment and email processing. Review the providers and transfer terms in our DPA when assessing your own obligations.
Guards and exclusions
Control exactly what gets tracked
OpenMetrica gives you four kinds of rule. IP addresses, countries and page paths are blocklists, so anything matching them is dropped. Hostnames work the other way round and behave as an allow-list, meaning that once you add one, every other hostname stops being counted, which is how you keep a staging copy of your snippet out of production numbers. Page rules support wildcards, and all four are enforced at the ingestion layer before anything is stored.
The details
Frequently asked questions
Answers before you get started.
Do I need a cookie consent banner with OpenMetrica?
The tracker uses no cookies or browser storage, but that alone does not establish a universal consent exemption. Requirements depend on local ePrivacy rules, how you use analytics and the rest of your site. Assess your lawful basis and notices before deploying it.
How can you count unique visitors without cookies?
The server derives a daily HMAC from the domain, IP, User-Agent and random salt. It counts pseudonymous browser-and-network combinations, rather than verified people. Shared networks, browser changes and IP changes affect visitor counts.
Do you use fingerprinting?
The tracker does not probe canvas, font lists or hardware. It sends viewport width for device categorization. On the server, we hash request IP and User-Agent into visitor pseudonyms; our internal schema calls the daily value a fingerprint hash. This server-side identification still needs to be considered in a privacy assessment.
Is OpenMetrica compliant with GDPR?
OpenMetrica provides cookieless measurement, site isolation, retention limits and a DPA to support your compliance work. GDPR obligations can still apply to IP processing and pseudonymous records. A lawful basis, appropriate notices, permitted event payloads and any required consent depend on your deployment.
Where is my data stored?
Visitor analytics data is processed and stored on servers within the European Union and is not transferred to the US or any third country. The service providers behind billing and email are listed in our DPA.
Can OpenMetrica identify individual visitors?
OpenMetrica does not provide named visitor profiles. Its HMACs distinguish pseudonymous browser-and-network combinations within a site. They are not a guarantee of irreversible anonymization; do not send names, email addresses or other personal details in event data or URLs.
How long is data kept?
Aggregated statistics for 25 months, the raw event log behind goals and funnels for 12 months, the per-pageview rows the statistics are built from for 7 days, and history you import for 5 years. Retention is the same on every plan. Deleting a site starts the erasure of its data, and you can export the aggregated statistics of any range as CSV first.
Does EU hosting settle every international-transfer question?
No. EU hosting limits where visitor analytics is processed, but account, payment and email providers have separate arrangements. Review the DPA and the applicable transfer safeguards for your organization rather than relying on a blanket Schrems II exemption.
Get started
Privacy-friendly analytics without compromise
Measure traffic without analytics cookies, with transparent visitor processing and a free plan. Read the privacy details before choosing your setup.