Cookieless and cookie mode
atrby counts visitors without cookies by default. Choose per site in Site settings → Install and privacy.
Cookieless (recommended)
Nothing is stored on the visitor's device apart from a visit id in sessionStorage, which ends when the tab closes. To count unique visitors, our server computes an id from a hash of a random daily salt, your site, the IP address and the user agent.
- The salt is made fresh each UTC day and the previous day's is deleted, so ids can't be linked across days or traced back.
- The IP address is used only for that hash and is never stored.
- The same person on two days counts as two visitors.
Cookie mode
Set the site to cookie mode and add data-cookie="true" to the script tag. The script then keeps a first-party cookie, atrby_vid, for a year, so returning visitors are recognised across days.
Both are needed: the attribute alone does nothing on a cookieless site. Cookie mode needs consent in the EU and UK, so load the script with the attribute only after the visitor agrees.
What is stored
| Per event | Page path without query, referrer host, UTM tags, country code, device type, browser, OS, event name, and the visitor and visit ids. |
|---|---|
| Per payment | Amount, currency, the processor's payment id, the matched source, and the customer email and name your processor sends. |
| Session replay | Only on sites where you turn it on: the page as the visitor saw it (structure, text, styles), pointer, clicks, scrolling and window size, for 30 days. Form values are masked, password fields are left out, and text marked data-atrby-mask is masked. Stored in our Cloudflare R2 bucket. |
| Never | IP addresses, full user agents, form contents, network requests or console output. Outside session replay, never the text of clicked elements. |
See data and retention for where this lives and for how long.