Visitor Sessions & Privacy

VeloStats measures visitor counts and sessions with zero reliance on cookies, localStorage, or persistent device fingerprints.

Daily Rolling HMAC-SHA256 Hash

When a beacon arrives at the ingestion server, a visitor hash is derived dynamically using:

• The visitor’s incoming IP address
• The visitor’s User-Agent string
• Screen dimensions (sw, sh), viewport width (vw), and browser timezone (tz)
• The site key
• A server-side cryptographic salt rotated every 24 hours

Visitor ID = HMAC_SHA256(IP + User-Agent + Screen/Viewport/Timezone + SiteKey, DailyServerSalt)

Why This Protects Privacy

1. No Cross-Site Tracking: Because the hash incorporates your unique site key, Visitor A on Site 1 produces a completely different hash on Site 2.
2. No Long-Term Profiling: Because the salt rotates daily, the hash changes every day. It is mathematically impossible to track a user’s behavior across multiple days.
3. GDPR / ePrivacy Compliance: Under EU GDPR, ePrivacy Directive, and CCPA, ephemeral daily hashes generated server-side for aggregate statistics do not require a cookie consent banner.

Four-Ping Lifecycle

VeloStats collapses user interactions into a single atomic session event via a unique pageview_id:

• pageview: Fired immediately when the page is loaded or an SPA route transition completes.
• load: Fired after window.load completes, attaching initial Core Web Vitals and navigation load timings.
• heartbeat: Fired once upon the first trusted human interaction (pointermove, scroll, keydown, touchstart, or click). This promotes the visit to a Verified Human visit.
• leave: Fired when the tab is hidden or closed (visibilitychange / pagehide), recording active engagement duration (paused automatically when the tab is in the background) and maximum scroll depth.