Privacy

What We Collect

Klar collects only the minimum data needed for analytics:

• Page URL — The path being visited
• Referrer — Where the visitor came from
• Screen width — For device type detection
• UTM parameters — For campaign tracking

What We DON'T Collect

We explicitly do not collect:

• ❌ Personal identifiable information (PII)
• ❌ Email addresses or names
• ❌ IP addresses
• ❌ Cookies
• ❌ Browser fingerprinting
• ❌ Cross-site tracking data
• ❌ Exact location data

GDPR Compliance

Klar is GDPR-friendly by design:

• No cookies required
• No personal data collection
• No consent banners needed
• Data processing agreement available

Under GDPR, Klar qualifies as a "simple measurement tool" because we don't process personal data.

CCPA Compliance

Klar does not sell visitor data. We don't collect information that could be sold or used for targeted advertising.

How Visitor Tracking Works

Klar uses a privacy-first approach to understand visitors without invading their privacy:

Visitor Counting

To count unique visitors without identifying them, Klar computes a one-way hash on its server — nothing is stored on the visitor's device:

visitor_hash = sha256( daily_salt + site + IP + user-agent )

• The daily_salt is a server secret that rotates every 24 hours and is never stored — so the same visitor produces a different hash each day and cannot be re-identified over time.
• The raw IP address is used only to compute the hash and is never stored.
• No cookie, no localStorage, no sessionStorage — nothing is written to the browser.
• Not a "real" identity — just a daily, per-site number to count unique visitors.

Session Tracking

• A session is derived from the same daily hash within a 30-minute window.
• It is computed entirely server-side — no session identifier touches the device.
• Because the salt rotates daily, sessions never link a visitor across days.

What We Know

• "This browser visited 5 pages over 10 minutes"
• "This is a new visitor to this site"
• "This visitor came from Twitter"

What We DON'T Know

• Who the person is (no name, email, etc.)
• Where they go after leaving your site
• What they do on other websites
• Their real IP address
• Any persistent identifier that follows them online

Comparison

Privacy-Preserving Features

No Cookies, Nothing Stored

Klar stores nothing on the visitor's device. This means:

• No cookie consent banners required in most jurisdictions
• No cookies, no localStorage, no fingerprinting
• Visitors can't be tracked across sites — or across days

Do Not Track & Global Privacy Control

Klar honors both the Do Not Track (DNT) and Global Privacy Control (GPC) browser signals by default — visitors sending either are not tracked and no identifier is stored. Site owners can opt out of this behavior with data-honor-dnt="false":

<script
  src="https://klar.alphabros.eu/klar.js"
  data-site-id="your-site-id"
  data-honor-dnt="true"
  defer
></script>

IP Anonymization

We don't store IP addresses at all. We get country info from Cloudflare headers (when available), but never store the full IP.

Data Retention

Data retention depends on your plan:

• Free: 30 days
• Starter: 90 days
• Pro: Unlimited
• Business: Unlimited

Older data is automatically deleted.

Data Security

• All data encrypted in transit (TLS)
• Secure database infrastructure
• Regular security audits
• No third-party data sharing

Your Data

You own all your data. You can:

• Export your data at any time
• Request complete data deletion
• Delete individual sites or events

Contact us at klar@alphabros.eu for data requests.