Privacy

What We Collect

Klar collects only the minimum data needed for analytics:

• Page URL — The path being visited
• Referrer — Where the visitor came from
• Screen width — For responsive layout insight
• Browser family — Chrome, Safari, Firefox and the like. Not the full version string
• Operating system family — macOS, Windows, Android and the like. Not the version
• Device type — desktop, mobile or tablet
• UTM parameters — For campaign tracking

What We DON'T Collect

We explicitly do not collect:

• × Personal identifiable information (PII)
• × Email addresses or names
• × IP addresses
• × Cookies
• × Browser fingerprinting
• × Cross-site tracking data
• × Exact location data

Browser and OS, and Why That Isn't Fingerprinting

Every request a browser makes carries a User-Agent header. Klar reads it on the server to record three coarse facts — a browser family, an operating system family and a device type — and discards the rest of the string. Your visitors send nothing extra: the tracker script does not read, collect or transmit the user-agent, and it is unchanged at 1.9 KB.

Browser fingerprinting means something specific and different: combining many high-entropy signals — canvas rendering, installed fonts, audio hardware, plugin lists, precise screen geometry, timezone — into a value distinctive enough to recognise one person across visits and across sites. Klar reads none of those, and the three families above are deliberately too coarse to single anyone out. Roughly two thirds of the web is Chrome.

We'd rather be precise than reassuring, so: storing a browser, an OS and a country against a pageview is not zero information. What makes it non-identifying is that there is no stable identifier to attach it to. Klar's visitor id is a one-way hash reseeded with a new secret every 24 hours, so yesterday's rows cannot be linked to today's, and nothing is stored on the device to bridge them.

GDPR Compliance

Klar is GDPR-friendly by design:

• No cookies required
• No personal data collection
• No consent banners needed
• Data processing agreement available

Under GDPR, Klar qualifies as a "simple measurement tool" because we don't process personal data.

CCPA Compliance

Klar does not sell visitor data. We don't collect information that could be sold or used for targeted advertising.

How Visitor Tracking Works

Klar uses a privacy-first approach to understand visitors without invading their privacy:

Visitor Counting

To count unique visitors without identifying them, Klar computes a one-way hash on its server — nothing is stored on the visitor's device:

visitor_hash = sha256( daily_salt + site + IP + user-agent )

• The daily_salt is a server secret that rotates every 24 hours and is never stored — so the same visitor produces a different hash each day and cannot be re-identified over time.
• The raw IP address is used only to compute the hash and is never stored.
• No cookie, no localStorage, no sessionStorage — nothing is written to the browser.
• Not a "real" identity — just a daily, per-site number to count unique visitors.

Session Tracking

• A session is derived from the same daily hash within a 30-minute window.
• It is computed entirely server-side — no session identifier touches the device.
• Because the salt rotates daily, sessions never link a visitor across days.

What We Know

• "This browser visited 5 pages over 10 minutes"
• "This is a new visitor to this site"
• "This visitor came from Twitter"

What We DON'T Know

• Who the person is (no name, email, etc.)
• Where they go after leaving your site
• What they do on other websites
• Their real IP address
• Any persistent identifier that follows them online

Comparison

Privacy-Preserving Features

No Cookies, Nothing Stored

Klar stores nothing on the visitor's device. This means:

• No cookie consent banners required in most jurisdictions
• No cookies, no localStorage, no fingerprinting
• Visitors can't be tracked across sites — or across days

Do Not Track & Global Privacy Control

Klar can honor both the Do Not Track (DNT) and Global Privacy Control (GPC) browser signals — visitors sending either are not tracked and no identifier is stored. Because Klar's privacy is already structural (storageless, no cookies, no PII, no fingerprinting), honoring DNT/GPC is opt-in rather than the default — enable it per site with data-honor-dnt="true":

<script
  src="https://klar.alphabros.eu/klar.v2.js"
  data-site-id="your-site-id"
  data-honor-dnt="true"
  defer
></script>

IP Anonymization

We don't store IP addresses at all. We get country info from Cloudflare headers (when available), but never store the full IP.

Data Retention

Each plan comes with a data-retention window:

• Free: 6 months
• Starter: 1 year
• Pro: Unlimited
• Business: Unlimited

These windows apply to data Klar collects. History you import from another analytics tool (a Plausible or Fathom export) is kept until you delete that import or the site.

Automatic deletion of data past that window is not live yet — we are building it (klar#637). Until it ships, analytics data is kept rather than pruned. You can delete a site and its data yourself at any time from the dashboard, and we will delete everything on request.

Data Security

• All data encrypted in transit (TLS)
• Secure database infrastructure
• Regular security audits
• No third-party data sharing

Your Data

You own all your data. You can:

• Export your data at any time
• Request complete data deletion
• Delete individual sites or events

Visitor ID and Session ID in raw exports

The raw pageview and event CSV exports include a Visitor ID and Session ID column. Both come from the same daily visitor hash described under "How Visitor Tracking Works" above — a per-day pseudonym, not a stable identifier:

• Visitor ID is the daily hash itself. It rotates at UTC midnight, so the same person gets a different Visitor ID on every day they visit.
• Session ID is that same daily hash combined with a 30-minute wall-clock bucket.

Because the hash rotates daily, COUNT(DISTINCT "Visitor ID") over an exported date range counts visitor-days, not people — a visitor who returns on three different days gets three different ids in the file. To count unique visitors, restrict the query to a single day.

The hash is keyed by the visitor's IP address and user-agent, but neither is stored or exported — only the one-way hash leaves the database, in the export file exactly as it does everywhere else in Klar.

Contact us at klar@alphabros.eu for data requests.