# Cookieless and cookie mode

> atrby counts visitors without cookies by default, uses a daily salt for visitor ids, and requires cookie mode plus consent in the EU and UK for a first-party cookie.

Canonical: https://atrby.site/docs/privacy
Last updated: 2026-10-21

atrby counts visitors without cookies by default. Choose per site in Site settings → Install and privacy.

## Cookieless (recommended)

Nothing is stored on the visitor's device apart from a visit id in `sessionStorage`, which ends when the tab closes. To count unique visitors, our server computes an id from a hash of a random daily salt, your site, the IP address and the user agent.

- The salt is made fresh each UTC day and the previous day's is deleted, so ids can't be linked across days or traced back.
- The IP address is used only for that hash and is never stored.
- The same person on two days counts as two visitors.

**Consent.** In cookieless mode atrby doesn't read or store anything on the device for analytics. Many sites run it without a consent banner; check with your own counsel for your jurisdiction.

## Cookie mode

Set the site to cookie mode and add `data-cookie="true"` to the script tag. The script then keeps a first-party cookie, `atrby_vid`, for a year, so returning visitors are recognised across days.

Both are needed: the attribute alone does nothing on a cookieless site. Cookie mode needs consent in the EU and UK, so load the script with the attribute only after the visitor agrees.

## What is stored

| Data | What is kept |
| --- | --- |
| Per event | Page path without query, referrer host, UTM tags, country code, device type, browser, OS, event name, and the visitor and visit ids. |
| Per payment | Amount, currency, the processor's payment id, the matched source, and the customer email and name your processor sends. |
| Session replay | Only on sites where you turn it on: the page as the visitor saw it (structure, text, styles), pointer, clicks, scrolling and window size, for 30 days. Form values are masked, password fields are left out, and text marked `data-atrby-mask` is masked. Stored in our Cloudflare R2 bucket. |
| Never | IP addresses, full user agents, form contents, network requests or console output. Outside session replay, never the text of clicked elements. |

See [data and retention](https://atrby.site/docs/architecture) for where this lives and for how long.

## Related
- [Proxy and self-hosting](https://atrby.site/docs/proxy)
- [Data and retention](https://atrby.site/docs/architecture)