Analytics without storing IP addresses

How unique visitors are counted with a daily-rotating salted hash, and what that deliberately makes impossible.

Counting unique visitors normally means storing something identifying. We chose a design that does not.

The mechanism

For each scan or click we derive a hash from the visitor's IP, their user agent and a salt that rotates every day. We store the hash. We do not store the IP.

Because the salt changes daily, the same visitor produces a different hash tomorrow. The hashes cannot be joined across days, and they cannot be reversed to an address.

What this gives up

Cross-day identity. We cannot tell you that 30% of Tuesday's visitors also came on Monday, because we deliberately destroyed the ability to know that.

Daily unique counts are accurate. Multi-day unique counts are a sum of daily figures, which slightly overstates true unique people — and we would rather overstate a metric than retain data we do not need.

Why the default is off, not on

Raw IP storage is available as an administrator setting for jurisdictions that require it, and it is off by default. A privacy default that only applies if someone finds the switch is not a privacy default.

Counting is not blocking

Analytics is written after the redirect has already been served. The visitor never waits for our aggregation, and if the queue is backed up the redirect is unaffected. Measurement should never be the reason a scan feels slow.

What a rotating salt actually prevents

The salt is a random value mixed into the hash before it is stored, and it is replaced every day. Two consequences follow, and both are the point.

Without a salt, a hash of an IP address is reversible in practice. The address space is small enough to hash exhaustively, so an attacker with the stored hashes can recover the original addresses in minutes. The salt makes that infeasible.

Rotating it daily prevents something different: linkage. If the salt never changed, the same visitor would produce the same hash forever, and the stored data would be a stable identifier — a pseudonym rather than an anonymous count. Rotating it means the same person on Monday and Tuesday produces two unrelated values, so no profile can be assembled across days even by us.

What this means for your reporting

Daily unique counts are accurate. Weekly and monthly unique counts are not sums of daily ones — a visitor returning on five days contributes five uniques, not one. This is a deliberate trade: cross-day identity is exactly the capability being given up.

If you need true multi-period unique visitors, that requires stable identification of individuals across time, with the consent, disclosure and retention obligations that come with it. Most reporting does not need it, and is better off without the liability.