# How visitors are counted

> How Privatus Analytics counts visitors and visits without cookies: a daily salted key computed in memory, random visit ids, and what that means for accuracy.

Privatus Analytics counts real visits and daily unique visitors without cookies,
without storing anything on the visitor's device, and with nothing that
persists or links across days.

## The daily visit key

1. Every UTC day we generate a random 256-bit **salt**. It exists only in
   memory (Redis without persistence) and is destroyed shortly after the
   day ends.
2. For each hit, `key = HMAC(daily_salt, site, IP, User-Agent)`, computed
   in memory during the request.
3. The key is looked up in an in-memory store. If it's new, we start a
   visit with a **random id** that is *not* derived from the key. Entries
   expire after 30 minutes of inactivity and never outlive the UTC day.
4. The stored event has the random visit id and flags such as "first visit
   today". The key, the IP and the raw User-Agent are never stored, logged
   or queued.

After midnight the salt is gone, so nobody (including us) can recompute a
key or link a stored visit to a person or to another day.

## Visits, visitors and bounces

- **A visit** ends after 30 minutes without a hit, or at midnight UTC,
  whichever comes first.
- **A visitor** is counted once per site per UTC day, on their first visit
  of the day. The same browser the next day is a new visitor, so a weekly
  total counts "visitor-days".
- **A bounce** is a visit with one pageview, no custom event and less than
  10 seconds of engaged time.

Funnels, journeys, entry and exit pages, and the pages viewed before a
conversion are all built from these visits. Server-side events join the
same visits (see [server-side sessions](/docs/server-side/sessions)).

## What this means for accuracy

- Visitors can't be deduplicated across days, by design. Someone who
  visits on Monday and Tuesday counts twice in a weekly total.
- Two people behind the same IP address with the same browser version
  (an office network, for example) can be counted as one visitor.
- A visitor whose IP address changes during the day (switching from Wi-Fi
  to mobile data) can be counted twice.
- A visit that spans midnight UTC is split into two.

See [why numbers differ from GA4](/docs/metrics/ga4-differences) for how
this compares with cookie-based tools.

## Your privacy policy

The IP address and User-Agent are processed transiently to build the daily
pseudonymous key, which you should mention in your privacy policy (see
[templates](/docs/privacy/policy-templates)).