Visitor Sessions & Privacy

VeloStats measures visitor counts and sessions with zero reliance on cookies, localStorage, or persistent device fingerprints.

Daily Rolling HMAC-SHA256 Hash

When a beacon arrives at the ingestion server, a visitor hash is derived dynamically using:

• The visitor’s incoming IP address
• The visitor’s User-Agent string
• The site key
• A server-side cryptographic salt rotated every 24 hours

Visitor ID = HMAC_SHA256(IP + User-Agent + SiteKey, DailyServerSalt)

Why This Protects Privacy

1. No Cross-Site Tracking: Because the hash incorporates your unique site key, Visitor A on Site 1 produces a completely different hash on Site 2.
2. No Long-Term Profiling: Because the salt rotates daily, the hash changes every day. It is mathematically impossible to track a user’s behavior across multiple days.
3. GDPR / ePrivacy Compliance: Under EU GDPR, ePrivacy Directive, and CCPA, ephemeral daily hashes generated server-side for aggregate statistics do not require a cookie consent banner.

Four-Ping Lifecycle

VeloStats collapses user interactions into a single atomic session event:

• pageview: Fired when the page is parsed.
• load: Fired when window.onload completes (reports page load duration).
• heartbeat: Fired after 15 seconds of active user engagement. This promotes the visit to a “Verified Human” visit.
• leave: Fired via sendBeacon when the tab is closed or navigated away, recording total time on page.