Privacy behaviour

This page describes Antlytics's product behaviour, not legal compliance status. Whether Antlytics meets your specific compliance obligations depends on your jurisdiction, your implementation, and other tools on your site. Consult your legal adviser for advice specific to your situation.

What Antlytics collects

For each pageview, Antlytics records:

Field	What it is
Pathname	The URL path of the page, for example `/blog/my-post`. Query strings and hashes are included in the raw event but the hash is not used for matching.
Referrer	The referring URL reported by the browser, if present.
Session ID	A UUID generated per-tab using `sessionStorage` (see below).
UTM parameters	`utm_source`, `utm_medium`, `utm_campaign`, `utm_content`, `utm_term` if present in the page URL.
Country	Derived from the visitor's IP address at the time of the request. Only the country code is stored — not the IP address itself.
Device type	Desktop, mobile, or tablet, derived from the User-Agent header.
Browser	Derived from the User-Agent header.
Operating system	Derived from the User-Agent header.

What Antlytics does not collect

Cookies — Antlytics sets no first-party or third-party cookies of any kind.
IP addresses — The IP address is used only to look up the country code. It is not logged, stored in the database, or associated with any event record.
Cross-site tracking — Antlytics tracks visitors only on sites that have explicitly installed the Antlytics tracking script. There is no cross-site identity.
Fingerprinting — Antlytics does not use canvas fingerprinting, font fingerprinting, or any other technique that would uniquely identify a visitor across sessions.
Personal data — No names, email addresses, phone numbers, or other personal identifiers are collected by the tracker.

How sessions work

Session continuity within a single browsing tab is tracked using a UUID stored in sessionStorage. This means:

The session ID is generated fresh when a visitor opens a new tab or window.
It is cleared automatically when the tab closes — it does not persist across browser sessions or restarts.
It is not shared between tabs, even on the same browser.
It cannot be used to track a visitor across different visits to your site.

This approach provides enough session continuity to calculate bounce rate and session-based metrics without creating a persistent cross-session identifier.

Unique visitor counting

Because Antlytics does not use cookies or persistent identifiers, unique visitors are estimated using a daily-rotating hash. The hash combines non-personal signals available at the time of the pageview request — these signals change day to day, so the same visitor appears as a new unique visitor on a new day.

This means:

Unique visitor counts are estimates, not exact individual counts.
Long-period unique visitor numbers (e.g. "unique visitors in the last 30 days") are approximations and may undercount or overcount repeat visitors.
This approach is a deliberate privacy trade-off: no persistent identifier means no cross-session tracking.

Third-party processors

Antlytics uses the following third-party services for its own operation:

Processor	Purpose
Clerk	Authentication and user management
Supabase	Database for storing analytics events and account data
Stripe	Payment processing for Starter subscriptions

Each processor handles data under its own privacy policy. Antlytics analytics data is not shared with these processors for their own purposes.

Compliance positioning

Antlytics is designed so that its default tracking configuration does not use cookies, does not collect IP addresses, and does not store personal data. This design may reduce your compliance overhead in some jurisdictions — for example, tools that do not use cookies may not require a cookie consent banner in some regulatory frameworks.

This is not legal advice. Regulatory requirements vary by jurisdiction, by the type of data you collect, and by other tools on your site. Consult your legal adviser to confirm your obligations.