What Track measures,
and what it doesn't.

Exactly what happens

No cookies, no script

Track places no cookies and no script in the page. It counts on the website's server, from the request the browser sends anyway to fetch the page. That request does hold data, such as the IP address and the user agent; what happens with that is described below.

What is used per visit

Per page visited, the website's server sends: the page's address without query, the title, how long the server took, the website the visitor came from (the domain name only) or, for a link within the website, the previous page, any campaign codes (utm_source or ref, utm_medium, utm_campaign), the browser's preferred language, the user agent and the IP address without its last part, so the full address doesn't leave the website's server.

Track uses that shortened address to look up the country, region and city, and the user agent to determine the browser, operating system and kind of device. To recognise a visitor within one day, Track makes a hash of the shortened address and the user agent with a random secret. Each day has its own secret per website, which is only held in memory and disappears at the end of the next day: a visitor can't be recognised the next day, or on another website. The shortened address, the user agent and the hash never go in the database. For up to about two days the memory holds per hash what has already been counted, to prevent counting twice, and Track briefly remembers the location of a shortened address. If Track can't be reached, the data waits in the memory of the website's server.

Routes and the origins of 404s are totals: how many people followed a link from one page to another. Track gets that from the previous page the browser itself sends along, and keeps no route per person. For a link between two subdomains of a website the browser only sends the subdomain; of those, Track counts how many people went from one to the other.

Of bots, crawlers and scripts Track uses only the user agent, to count them by name, such as Googlebot or GPTBot. Their address isn't sent, and they never count as a visitor.

Track counts requests for addresses scanners try on every website, such as /.env or /wp-login.php, separately. Of those only the address and the status go to Track, nothing about who tried. Anyone who opens five unknown addresses in a row in one day, without a link to them, counts as a scanner from then on.

To recognise programs dressed up as browsers, the middleware looks at whether a request has the usual headers modern browsers always send. Only a signal about that goes to Track, none of their values. Track counts per day how many page views that were, along with views without a language, from very old browser versions and from the networks of large hosting companies. Track looks that last one up with the visitor's network, and keeps only the number, not which network it was. Nothing in it says who they are.

What is kept

Only totals per day: how many page views, visitors and visits, how many visitors per page, per country, per city, per browser, and so on. Each characteristic is counted separately, so there's no row with a combination of city, browser and pages. There are three combinations: the first page of a visit with the channel it came from, such as ‘search engine’, which the dashboard shows only from 10 visits; two pages with the link between them, from 3 people; and a page that doesn't exist with where people came from. Individual page views aren't kept. On a quiet day a total can be about very few people, and paths and titles are what your website itself puts in them: don't put names or codes there.

The totals are kept for 25 months by default and never longer, so you can compare a month with the same month a year earlier. A website's owner can set that shorter. If the website is deleted, its statistics disappear too.

Who sees the statistics

Only the account that registered the website. Track's administrator doesn't see in the application which websites an account tracks either, nor their statistics: only how many websites there are.

Where Track runs

Track runs at DigitalOcean in Amsterdam, with Cloudflare in front. These are American companies, which can see the traffic to Track, including the shortened address. If data ends up in the United States, that happens under the EU-US Data Privacy Framework or standard contractual clauses.

This website itself

Whoever signs in to Track gets a session cookie. Whoever chooses a language gets one cookie that remembers it. Neither is used to follow anyone.

The security check

An owner can have Track look at their own website from outside every day: whether files are open that shouldn't be public, whether the certificate and HTTPS are right, which security headers there are, and whether the modules the server is built with have known vulnerabilities. Track compares that with Go's own database, so that list goes nowhere else. Track only makes ordinary requests, only goes on if the server proves with the token that the site belongs to this account, and only keeps what it found. No visitors are involved.

Not being counted

Anyone who doesn't want to be counted can say so on every website with Track at /track-opt-out. The browser then remembers that with one cookie, set only on that request and doing nothing else. If the browser sends Global Privacy Control or Do Not Track, Track doesn't count that visitor either. This works from that moment on: earlier visits are only in totals per day and can't be taken out separately. Bots and scan attempts always count, since nothing about a person is in them.

What Track doesn't do

• Follow visitors over several days or across websites
• Recognise returning visitors
• Make profiles, or sell data to others
• Use data for ads

Consent and legal basis

Track uses no cookies and no script, and keeps no IP addresses. So in the Netherlands you don't, as a rule, need a cookie banner for it, provided you mention Track in your privacy statement: the Dutch Telecommunications Act (article 11.7a paragraph 3) allows statistics with no or minor effects on privacy without consent. No court or regulator has confirmed that for this way of measuring, and regulators also count reading IP addresses and headers under that rule.

Outside the Netherlands it can be different. France and Spain exempt campaign measurement among other things, Italy looks at recognising individual visitors and Germany has no such exception. If you also use other services, such as Google Analytics, that service often does ask for consent.

The brief use of the shortened IP address falls under the GDPR. The website's owner can rely on a legitimate interest: insight into the use of their own website, with as little data as possible. Record that assessment and mention Track in your privacy statement, with a link to /track-opt-out.

This is not legal advice: check what applies to your website.