Count visits. Leave people alone.
How PostDeploy Analytics counts traffic, field by field: what leaves the browser, what the server keeps, and where its knowledge deliberately stops.
In the browser
The tracker sets no cookies and writes nothing to local storage. It keeps a few values in page memory, which disappear when the page closes.
Before sending a pageview it removes query parameters and fragments from the address, except utm_source and utm_campaign, and shortens the referrer to the referring site.
While a page is visible it sends a small activity signal every 30 seconds and when the page is hidden or closed. Activity measures visible time and never counts as a pageview or a goal.
"site": "fernhill"Public project ID.
"type": "pageview"Pageview, named event or activity.
"url": "https://fernhill.example/shop/linen?utm_source=newsletter"Trimmed address.
"referrer": "https://news.example/"Referring site only.
"page": "9f2c41d07a3e8b65…"Random per page view.
On the server
The Worker validates each event, derives a few coarse attributes from the request, and stores only what reports need.
| Data | Kept | Notes |
|---|---|---|
| Page path | Stored | Without other query parameters or fragments. Excluded paths are dropped before storage. |
| Referring site, source, campaign | Stored | Campaign values come from utm_campaign as written in your links. |
| Country, device type, browser | Stored | Derived from the request, then kept as coarse labels. |
| Daily visitor hash | Stored | A hash using a salt that rotates daily. Salts older than two days are deleted. |
| Goal names and revenue | Stored | Only what your website sends with postdeploy.track(). |
| IP address | Not stored | Used in memory to compute the daily hash, never written. |
| Full user agent | Not stored | Reduced to device type and browser. |
| Cookies or device IDs | Not stored | The tracker never sets them. |
Counting visitors
Because the salt changes each day, the same person gets a different hash tomorrow. PostDeploy can count visitors within a project and a day, and it can’t link one day to the next.
So reports talk about visitor-days. Totals over a month add up daily counts, and organisation totals add up projects. Neither claims to know how many distinct people visited.
Conversion rates follow the same rule: converted visitor-days divided by visitor-days in the same window.
- Visit
- Ends after 30 minutes without activity, at local midnight, or when the time zone changes.
- Visible duration
- Measured only while the page is visible. Visits without measurements are reported as unknown.
- Rate limits
- One daily visitor can send a burst of 20 events, then about one per second.
Your controls
- New projects honour Do Not Track and Global Privacy Control and skip known bots.
- Exclude up to 20 path prefixes per website, such as
/accountor/checkout/confirm. Matching pages, including encoded variants, are dropped before storage. - Only the canonical hostname and up to 20 aliases can send production data.
- Choose a retention period of 6, 12 or 24 months, or keep events forever.
- Reports require sign-in. There are no public dashboards.
Check your campaign links
The tracker keeps utm_campaign and unexcluded paths as written. If either can contain personal data on your website, such as an email address in a campaign name or a username in a path, exclude or rename it.
What we don’t claim
PostDeploy Analytics does not detect personal data automatically, and it is not certified against GDPR, ePrivacy or any other regulation. Using cookieless analytics may reduce what you need to ask visitors for. Whether it does depends on your website, your configuration and your jurisdiction.
The installation and its data sit in your Cloudflare account, so you, as the operator, decide retention, access and any agreements with Cloudflare.
This website
analytics.postdeploy.dev counts its own visits with PostDeploy Analytics, using the tracker described on this page. These public pages load no third-party scripts, fonts or images.
The private dashboard at this address is for invited team members. Signing in sets a session cookie that keeps a team member signed in. Visitors to the public pages never receive one.
Clicks on the GitHub and Deploy to Cloudflare links are recorded as named events, so we can see which links people use.
Read the code that does the counting.
The tracker and the Worker are in the public repository.