Add your site in your account to get a key, then paste before </body>:
<script src="https://ethical-analytics.com/ea.js" data-site="YOUR-KEY" data-endpoint="https://ethical-analytics.com/collect.php" defer></script>
No-JS fallback (emails, AMP-ish contexts, paranoid pages):
<img src="https://ethical-analytics.com/collect.php?k=YOUR-KEY" alt="" width="1" height="1">
| Stored | Detail |
|---|---|
| Path | e.g. /pricing — query strings and fragments stripped, with one exception: the three campaign tags utm_source, utm_medium, utm_campaign are kept (length-capped); every other parameter is discarded on arrival |
| Referrer domain | domain only (google.com), never the full URL; same-site referrers dropped |
| Device class | mobile / tablet / desktop, from viewport width only |
| Browser family | Chrome / Firefox / Safari / Edge / Opera / Other — then the user-agent is discarded |
| Anonymous visitor hash | see below — resets daily by design |
| Timestamp + your site key | and a bot flag (crawlers counted separately) |
| Custom events (optional) | a name you choose (ea.event("signup") — lowercase letters, digits, _, -) plus the page path and timestamp; same daily-hash anonymity, no payload field by design |
Never stored: IP addresses, cookies, localStorage, full referrer URLs, raw user-agents, screen fingerprints, names, anything typed on your pages.
Counting unique visitors normally means recognising people — the creepy part. Our compromise: each visit is hashed (SHA-256) from the visitor's IP + user-agent + your site key + a secret salt that is destroyed and regenerated every UTC day. Within one day, repeat visits count as one visitor; across days, the old salt no longer exists, so yesterday's hashes are mathematically unlinkable to today's — by us, by you, or by anyone who stole the database. The raw IP touches memory only long enough to be hashed and is never written anywhere. The trade-off is honest: our "7-day visitors" is really "sum of daily uniques" and slightly overcounts returning visitors. We think that's the right price for actual anonymity, and we print the caveat rather than hiding it.
Because the anonymous hash is stable within one UTC day, we can show sessions (a visit ends after 30 idle minutes), entry and exit pages, in-day journeys and conversion counts — with no cookies and no identity. What we cannot show, ever, is the same person returning tomorrow: the salt that made today's hashes is destroyed at midnight UTC. Sessions never span days. This is the deliberate line between useful analytics and recognising people.
If a visitor's browser sends Do Not Track or Global Privacy Control, the script sends nothing — and if a ping arrives anyway (the pixel path), the server drops it. Respecting visitors simply don't appear in your numbers. We think sites that would rather not know this exist shouldn't use us.
Two layers, deliberately different. Raw rows — the only rows carrying the anonymous visitor hash — are purged within 90 days at most on every plan, sooner if the site's history setting is shorter. Paying more never extends this: it is a promise to your visitors, and a raw window you could buy longer would turn that promise into marketing. Before a completed day is purged it is condensed into aggregate statistics — daily totals, sessions and bounce counts, plus per-page, per-referrer, per-device, per-campaign and per-event counts. These aggregates contain no visitor hashes at all (pure counts), so keeping them adds zero personal data. How long the aggregates are kept is the site's retention setting — this is the part that is honestly a plan feature: sites on a Free account keep 60 days; on a Pro account you dial each site from 1 month to indefinite (default 3 years). A day is never purged before it has been rolled up. Removing a site from your account deletes its data — raw rows and aggregates — immediately. Deleting your account (email us) deletes everything.
The plan is per account, priced per site: a Free account covers two sites; a Pro account pays £5/month or £40/year per site ($6/month or $48/year on USD accounts — pick your currency at signup), and every site on it gets the Pro features. One toggle, no mixing to keep track of: your account is Free or it is Pro.
You cannot buy Pro yet. The price is decided but there is no checkout in this product, no card form, and no billing code. Pro exists, it works, and today the only way to get it is to email us and ask. We would rather tell you that than put up a pricing page with a fake buy button on it.
| Per account | Free | Pro |
|---|---|---|
| Price | £0 (covers two sites) | £5/month or £40/year per site ($6 / $48 in USD) |
| History kept & report look-back | 60 days | you choose, per site: 1/3/6 months, 1–5 years, or indefinite (default 3 years) |
| Rows per table | 10 | 200 |
| Pages, referrers, campaigns, events, entry/exit | yes | yes |
| CSV export | — | yes |
| Read-only API | — | yes, 10 tokens per site |
| Raw (visitor-level) retention | ≤90 days on every plan — the privacy floor; never a paid dial | |
| Cookies set on your visitors | none | none |
A Free account is a real product, not a demo: same numbers, same privacy design, shorter history and shorter tables. If Free answers your question, use Free.
A read-only JSON endpoint returning the same figures as your report. Every token is scoped to a single site on a Pro account — the narrow scope is the design, not an option — and the API is a Pro feature, so a Free account's data is never readable over it. Tokens are shown once at creation; we store only a hash, so we cannot recover one for you — revoke and re-mint instead.
curl -H "Authorization: Bearer eak_…" \ "https://ethical-analytics.com/api.php?ep=report&site=SITEKEY&from=2026-01-01&to=2026-01-31"
Endpoints: ?ep=sites (what this token can read), ?ep=report (the full drilldown for one site), ?ep=series (per-day pageviews and uniques). Use &token=eak_… instead of the header if your tool cannot set one. Nothing here writes, so the worst a leaked token can do is show someone your traffic numbers for the sites it was scoped to — which is exactly why the scoping exists.
The daily_uniques_sum field is named that on purpose. It is the sum of each day's unique count, not a de-duplicated visitor count for the range, because the hashing salt is destroyed nightly and nobody — us included — can link a visitor across days. Any analytics product that gives you a range-wide "unique visitors" number is either keeping something we refuse to keep, or guessing.
Ad-blockers block us like any analytics (expect real traffic to be a bit higher than reported). Daily-unique summing overcounts weekly/monthly visitors (above). No session recordings, no cross-day or cross-site journeys, no returning-visitor rates, no retention cohorts — not missing features; refused ones, because each requires recognising people across days. Journeys and funnels exist within a single day only (above). If you need more than that, you need a different product and a longer privacy policy.