No cookies
Nothing is stored on the visitor's device: no cookies, localStorage IDs or fingerprints.
No IP addresses stored
IP addresses are used in memory for a location lookup and the daily hash, then discarded.
Daily-rotating hash
Unique visitors are counted per day. Visitors can't be linked across days, sites or devices.
What the script sends
When a page loads (or a single-page app changes route), the script sends one small request to https://plainwebanalytics.com/api/event containing:
- the event name (
pageview, or a custom event name you chose); - the page URL and the referring URL (
document.referrer); - the site's domain;
- the browser window width, used to classify the device as mobile, tablet, laptop or desktop;
- any custom properties or revenue amount you attach to an event;
- when the visitor leaves a page: how far they scrolled (as a percentage) and how long the page was visible and focused.
Like every web request, it also carries the visitor's IP address and the browser's user-agent string. The script stores nothing in the browser.
What we store
From that request our servers derive and store the following for each event:
| Stored | How it's derived |
|---|---|
| Time, event name | As sent |
| Page path and hostname | From the page URL. Query strings are dropped, except the utm_* campaign parameters and the name (never the value) of an ad click ID such as gclid. |
| Referrer and source | Referring host and path, without its query string, plus a source name such as “Google” and a channel such as “Organic Search”. Links from your own site are ignored. |
| Country, region, city | Looked up from the IP address in a local database. The IP address itself is not stored. |
| Browser, operating system, device type | Browser and OS name with version, parsed from the user-agent. The full user-agent string is not stored. |
| Visitor ID | A one-way hash (SipHash) of IP address + user-agent + site domain with a secret random salt (see below). |
| Visit ID | A random number that groups the events of one visit; a visit ends after 30 minutes of inactivity. |
| Custom properties, revenue | Only what the site owner chooses to send. Site owners must not send personal data in properties. |
| Scroll depth, engaged time | As sent by the script when a visitor leaves a page. |
How unique visitors are counted
To tell one visitor from another without cookies, PlainAnalytics computes a hash of the visitor's IP address, user-agent and the website's domain, combined with a random 16-byte salt. A new salt is generated every day at midnight UTC, and salts are deleted after 48 hours (the previous day's salt is kept briefly so that a visit spanning midnight isn't counted twice).
Because the salt is secret and destroyed, a stored hash can't be reversed into an IP address, and the same person produces a completely different hash tomorrow, on another website, or on another device. This means PlainAnalytics can say “120 people visited today” but can never say who they were or follow anyone over time.
What we never collect
- Cookies, localStorage, or any other identifier stored on the device
- IP addresses (not in our databases, not in our logs of analytics events)
- Full user-agent strings, screen resolutions or other fingerprinting signals
- Names, email addresses or account IDs of your visitors
- Behaviour across websites or across days
Bots, automation and opting out
Requests from known bots and crawlers, headless browsers and automation tools are discarded. Anyone can stop their own visits being counted by setting localStorage.plausible_ignore = "true" in their browser's console on your site. Site owners can also exclude IP ranges, countries, pages and hostnames — see Excluding traffic.
Where data is stored and for how long
Analytics data is stored on servers in London, United Kingdom. It is kept for as long as the site is in your account. When you reset a site's stats, delete a site or close your account, the related analytics data is permanently deleted.
We never sell analytics data, share it with advertisers, or combine it with data from other sources.
GDPR, PECR and CCPA
Because PlainAnalytics stores nothing on the visitor's device and doesn't process data that identifies individuals, using it on its own generally doesn't require a cookie or consent banner under UK and EU rules, and it doesn't involve “selling” personal information under the CCPA. You remain responsible for your own site, so if you're unsure, check with your adviser. For how we handle data about our own customers, see our privacy policy.