How cookie-free counting works

“Unique visitors without cookies” sounds like magic until you see the trick: a one-way, day-scoped token that forgets everyone at midnight.

• Key takeaways
• Visit grouping = hash(site + coarse IP + UA + daily salt), computed in memory.
• The salt rotates daily and is never stored, tokens can't be reversed or linked across days.
• Trade-off: returning visitors count as new each day; trends stay fully comparable.

The token

For each incoming pageview we compute, in memory: hash(site_id + coarse_ip + user_agent + daily_salt). The salt rotates every 24 hours and is never stored. The result is an opaque token that groups one visitor's pageviews within a day into one visit.

Why it cannot identify anyone

• The inputs are discarded; only the hash remains, and hashes with a destroyed salt cannot be reversed or recomputed.
• Tokens differ per site, so two BobRay customers can never correlate a visitor.
• Tokens differ per day, so there is no long-term profile even on one site.

The honest trade-off

A person returning on Tuesday counts as a new visitor versus Monday. Daily and weekly uniques are therefore conservative estimates, we think slightly humbler numbers are a fair price for zero surveillance, and trend lines remain fully comparable over time.

Common pitfalls

The mistakes we see most often on this topic, so you can skip them entirely.

• Comparing our daily uniques to cookie-based monthly uniques and calling it a bug.
• Assuming the token can be subpoenaed into an identity, its inputs no longer exist.
• Expecting cross-site journeys; tokens are per-site by construction.

Quick reference