How to count a person for one day without a cookie

Nine refreshes from you is not nine live visitors. Anyone who has watched a dashboard while debugging knows this. Cookies would fix the count and wreck the privacy story. Fingerprints would be worse.

Some cookieless tools call an entry pageview a “visitor”: if the referrer host is not your site, it counts as one. That needs no IP. It also treats every typed-in return visit as a new person, and it cannot collapse nine reloads.

What we do instead

The server reads the IP and user-agent in memory, HMACs them with the site, a pepper, and a salt that changes at UTC midnight, and stores only that token. Raw IP is discarded. Yesterday’s salt is deleted. The token cannot be joined to yesterday.

Live now is distinct tokens in a short window. Visitors is distinct tokens per local day. People on the same office network and browser can look like one person. That is the trade.

Say it plainly

This is not anonymous. A daily hash of an IP is still personal data under GDPR. We use it because you asked for “one person today,” and because a cookie would be the wrong answer. You remain responsible for how you describe the script on your own site. Engineering version: /methodology.