Cookieless analytics. Zero legal gymnastics.
Sift measures traffic, not people. We never store personal data, we never drop cookies, and you never have to force an annoying consent banner on your visitors.
How Unique Visitors are Counted
Most analytics software creates persistent unique identifiers that track a person for months across multiple tabs and sites. Sift does not.
When a request arrives at the Cloudflare edge, Sift computes a one-way cryptographic hash:
hash = SHA-256( Client IP + User Agent + Daily Salt )The Daily Salt rotates every 24 hours at 00:00 UTC and is destroyed. Because the hash cannot be reversed and changes daily, it is mathematically impossible to track a person across consecutive days or across different websites.
The Only Data We Receive
Sift does not scrape browser canvas fingerprints, battery status, or font lists. Here is the entire JSON payload sent by the tracker:
{
"p": "/pricing", // The current URL pathname
"r": "news.ycombinator.com", // HTTP referrer source
"w": 1440 // Viewport width (for screen bucket)
}Derived at Edge (Not stored raw)
- • Country, Region, City (from edge lookup)
- • Browser family & Operating System
- • Device category (Mobile / Desktop)
Never Touched or Retained
- • Raw IP addresses (discarded immediately after hashing)
- • Canvas or hardware fingerprints
- • User accounts or cross-site browsing history
Why You Don't Need a Cookie Banner
Under the European Union's ePrivacy Directive (Article 5(3)) and GDPR, consent banners are strictly mandated when a website stores or accesses information on the visitor's terminal device (such as setting cookies or accessing localStorage).
Because Sift does not set cookies, does not read persistent identifiers from the visitor's computer, and hashes edge data ephemerally, no consent banner is legally required. Your site remains 100% compliant and your users enjoy an unobstructed experience.
Privacy Comparison Matrix
| Data & Privacy Property | Sift | Google Analytics 4 | Plausible / Umami |
|---|---|---|---|
| Cookies created or stored | No | Yes (Invasive) | Yes |
| Local storage tracking keys | No | Yes (Invasive) | No |
| Raw IP address stored in database | No | Yes (Invasive) | No |
| Cross-site visitor fingerprinting | No | Yes (Invasive) | No |
| Ad network / Google profile sharing | No | Yes (Invasive) | No |
| Requires cookie banner under GDPR | No | Yes (Invasive) | No |
| EU data residency compliant | Yes | No | Yes |
| 24-hour rotating cryptographic salt | Yes | No | Yes |
Want to see the code?
Explore our quickstart guide to see how simple it is to deploy.