How our privacy works

• IP addresses — your IP is processed transiently in memory to help count visitors, but it is never written to disk, never logged, and never stored in any database.
• User agent strings — we extract the browser name and OS for dashboards, then the raw string is used only in transient processing and discarded.
• Recoverable hashes of personal data — other tools hash IP + User-Agent and store that hash for 24 hours. Those hashes can be brute-forced or rainbow-tabled. We go further: personal data is hashed, then immediately destroyed by feeding it into a mathematical structure that makes reconstruction impossible (see below).
• Cookies — none set, none read. No consent banner required.
• Browser fingerprints — we don't canvas fingerprint, enumerate fonts, or probe APIs to identify browsers.

• Page URL and referrer — which pages were visited and where traffic came from.
• Country — derived from the edge location, not from the IP address.
• Browser family and OS — "Chrome" and "macOS", not the full user agent string.
• Device type and screen size — desktop, mobile, or tablet.
• UTM campaign parameters — source, medium, campaign, term, content.
• Engagement events — scroll depth, time on page, outbound clicks, custom events you define.
• Behavioral signals as aggregate rollups — rage clicks, dead clicks, scroll hesitations, and reading speed are stored as hourly aggregate counts, not as individual reconstructible events. You see "42 rage clicks on /pricing this hour," not a timeline of one visitor's frustration.

Why this is irreversible — not just "hard to reverse"

A stored hash (like Plausible or Fathom use) is pseudonymous — there are only ~4 billion IPv4 addresses, so a hash of an IP can be brute-forced in seconds. Our approach is fundamentally different:

• Information is destroyed, not hidden. The counting structure records only the statistical pattern of the data, not the data itself. Multiple visitors map to the same register slot — the structure literally cannot distinguish them.
• It's like a turnstile counter. You can read "847 people entered today" but you cannot reconstruct who they were. That information was never recorded — it was counted and thrown away.
• Daily salt prevents cross-day correlation. Even the intermediate hash changes completely every midnight. The same visitor produces a totally different hash tomorrow.

The key difference

Why this isn't personal data

• Derived from an anonymous hash — the session ID is computed from the same irreversible visitor hash, not from any personal information.
• Server-side only — no tokens are stored in the browser. Zero client-side storage writes.
• Daily rotation — the underlying visitor hash changes every day, so sessions cannot be correlated across days.
• Not linkable — you can't connect two sessions from the same person across visits or devices.

• Email pattern stripping — any string matching an email pattern is automatically removed from event data before storage.
• URL query string removal — form action URLs, outbound links, and file download URLs are stripped to hostname and path only. Query strings (which often contain personal data like email, tokens, or IDs) are never stored.
• DOM snapshot text redaction — when DOM snapshots are captured for heatmaps, all visible text is replaced with block characters. Snapshots are further limited to elements explicitly opted in via data-hm-paths attributes.
• Copy-text truncation — text copied by visitors is limited to 20 characters with email pattern redaction applied, preventing accidental capture of personal data from clipboard events.

• No consent banner needed — no cookies or personal data processing to consent to.
• No DPA required — no personal data is shared with or processed by INSG.
• No privacy policy mention needed — though you're welcome to mention you use INSG for analytics.
• Edge processing — all data is processed on our global edge network, close to where your visitors are.

Why this works everywhere

Privacy laws differ in scope, enforcement, and terminology — but they all regulate the same thing: personal data. When analytics data is irreversibly anonymous and contains nothing that could identify, single out, or track a specific person, it falls outside the scope of these regulations entirely. INSG doesn't rely on exemptions, consent frameworks, or legal workarounds. We simply don't collect the data these laws were written to protect.