Visitors

A unique visitor represents one person visiting your site within a given day. MetriXs counts visitors without cookies or persistent identifiers.

How unique visitors are identified

For each incoming event, MetriXs computes a daily visitor hash using HMAC-SHA256. The daily salt is the HMAC key; the message is a server secret, the IP, the User-Agent, and your domain:

visitor_id = HMAC-SHA256(
  key   = daily_salt,
  msg   = HASH_SECRET + ":" + ip_address + "|" + user_agent + "|" + domain
).slice(0, 32)   // 16 bytes, 32 hex chars

• daily_salt — a secret random value that rotates at midnight UTC every day (used as the HMAC key)
• HASH_SECRET — a server-side secret, never sent to the browser
• ip_address — the visitor’s IP (never stored raw)
• user_agent — the browser’s user agent string
• domain — your site’s domain (prevents cross-site linking)

The resulting 32-character hex hash is stored. The raw inputs are discarded immediately.

What this means for counting

• Two pageviews from the same person in the same day → 1 unique visitor
• The same person visits the next day → 1 new unique visitor (salt has rotated)
• Two different people with the same IP and browser → may be counted as 1 visitor (rare, e.g. shared office NAT)

Why the salt rotates daily

Because the salt is the HMAC key and it rotates every day at midnight UTC, the same person receives a different hash each day. Even if someone obtained a hash, they could not reconstruct the visitor’s identity, reverse it back to the raw IP, or link sessions across days.

GDPR compliance

Because MetriXs never stores IP addresses, email addresses, or any identifier that can be linked back to a natural person, it is compliant with GDPR Article 4 — no personal data is processed.