What we collect and what we don't
Simple Analytics collects just enough data to give you meaningful insights, without compromising your visitors' privacy.
| Data point | Collected |
|---|---|
Page viewsWe collect the URL of each page visited, but only store the protocol, hostname, and pathname. Query parameters and fragments are stripped. Count of pages visited | |
Unique visitsUnique visits are detected using the referrer hostname, not cookies or IP addresses. If the referrer domain matches the current page domain, it counts as a non-unique visit. Via referrer, not cookies | |
ReferrersWe store the referring URL without query parameters or fragments (only protocol, hostname, and pathname) to answer "where did this visitor come from?" Without query parameters | |
UTM parametersWe track utm_source, utm_medium, utm_campaign, and utm_content. The utm_term parameter is deprecated as it may contain user data. Custom parameters like ref= and source= are also saved as utm_source. Campaign tracking | |
Device dimensionsWe collect browser viewport dimensions (innerWidth/innerHeight) and device screen dimensions (screen.width/screen.height) to help you optimize for all screen sizes. Screen and viewport sizes | |
CountryCountry is derived from the visitor's browser time zone (IANA time zone database), not their IP address, so VPNs don't affect it. Almost every country is covered, but a few time zones are missing from our mapping or shared across borders, so some visitors may be tagged under the wrong country. This is limited to country-level: we can't determine city or region. From timezone, not IP Check yours | |
LanguageWe collect the device language and its region (e.g. English US vs English UK). This data is available through our APIs for advanced users. Device language setting | |
Time on pageWe measure how many seconds a page is viewed. If the page is hidden (e.g. the user switches tabs), those seconds are not counted. Two requests are linked by a data point ID to calculate the duration. Excluding hidden time | |
Scroll depthWe record how far a visitor scrolls on each page, stored as a percentage in 5% increments. This helps you understand how much of your content visitors actually see. In 5% increments | |
User agentUser agents are anonymized by truncating version numbers (e.g. Chrome/78.0.3904.108 becomes Chrome/78.0.0.0) and stripping identifiers like Facebook tracking data. Used only for OS, browser, and device type stats, never for fingerprinting. Anonymized, versions truncated | |
CookiesWe never set any cookies or use similar technologies like local storage, session cookies, or fingerprinting. This means you don't need a cookie consent banner. Never set any cookies | |
IP addressesIP addresses are dropped from every single request. We don't save, collect, or hash them. Even in server logs, IPs are replaced with zeros before being stored. Never collected or hashed | |
Personal dataNo personally identifiable information is ever collected. IDs used for linking data points, pages, and page loads are not tied to individuals and are never stored on the device. No PII whatsoever | |
FingerprintsWe never use device fingerprinting techniques. User agents are only used for aggregate stats (browser, OS, device type), never to identify individual visitors. No device identification | |
Cross-site trackingWe never track visitors across different websites. Each website's data is completely isolated. There is no way to link a visitor on one site to the same visitor on another. No tracking across sites | |
Local storageNothing is stored on the visitor's device: no local storage, no session storage, no cookies. Page-load IDs exist only in memory and reset on reload, full navigation, or closing the page. Nothing stored on device |
Why is this important?
Privacy-first analytics isn't just about compliance - it's about building a better web.
Build trust with your audience
When visitors know you respect their privacy, they trust you more. Trust leads to longer sessions, more conversions, and loyal customers who recommend you to others.
Better UX without banners
Cookie banners are annoying and hurt your conversion rates. Without cookies, you don't need consent banners. Your visitors get a cleaner experience from the first click.
No opt-out, no data loss
Without a cookie banner, there's no "reject all" button. You get complete analytics data for all your visitors, not just the percentage that accepts tracking.
Questions we often get
Can't I get the same numbers from my server logs?
Not quite. Server logs record every request that reaches your server, including many bots, and miss pages served from a cache or CDN. They can't see what only the browser knows, such as the time zone we use for the country, screen size, scroll depth or events, and single-page apps often change pages without a new request. Logs also usually contain full IP addresses and user agents. Simple Analytics runs in the browser, blocks robots by user agent and browser traces, records events and page changes, and doesn't store IP addresses.
Do you collect IP addresses, even for a moment?
Every request from a browser carries an IP address, so it reaches our servers in transit. We don't store it in the analytics data and don't hash it. In server logs, IP addresses are replaced with zeros before anything is stored. If you turn on advanced robot blocking, the IP is first compared with a list of data-center IP ranges and then dropped.
What do you do with the user agent?
We use it only to count browsers, operating systems and device types. Version numbers are truncated (Chrome/78.0.3904.108 becomes Chrome/78.0.0.0) and identifiers such as Facebook tracking data are stripped. It is never used to identify or recognize a visitor.
Can I filter your data to the visitors who rejected consent?
Not by default. Simple Analytics doesn't read your consent banner, so it doesn't know who accepted or rejected. You can send the banner state (for example before, accepted or denied) as metadata with each pageview, as Hebban did in its comparison, and then filter on it. The metadata is a label, not personal data.
Can I follow a visitor from Google to a purchase?
Not per person, because there is no visitor identifier. You can see how many visits to a page came from Google, count events such as a purchase, and build goals with funnel steps. Each funnel step is a filter, for example on the page path or the referrer path, so funnels show how pages relate in aggregate, not individual journeys.
How do you filter bots?
By default we block robots based on their user agent and traces they leave in the browser. Advanced robot blocking, a setting in your account, also tags visits from known data-center IP ranges as robots. IP addresses are never stored, not even hashed.
For developers & legal teams
Need the full technical details? Our documentation covers every metric we collect, how we process it, and our legal compliance.
Read the full documentation