Privacy
Privacy model
Vector 5 measures audiences, not people. No cookies, no localStorage IDs, no fingerprints, no stored IPs.
Vector 5 Analytics measures audiences, not people.
docs/privacy-model.md
What we collect
| Field | Why | Stored? |
|---|---|---|
| Page path | Traffic reports | Yes |
| Referrer host / source | Attribution | Yes (host only) |
| UTM parameters | Campaigns | Yes |
| Country / region | Geo breakdown | Yes (IP discarded after lookup) |
| Device, browser, OS, screen width | Device reports | Yes |
| Event name and optional props | Goals | Yes |
| Actor and AI source | AI traffic | Yes |
| Visitor hash | Unique visitors for one UTC day | Yes |
| IP address | Hash + geo only | Never stored |
| Cookies / localStorage IDs | — | Never |
| Fingerprints | — | Never |
Unique visitors
formula
visitor_hash = SHA-256(daily_salt || site_id || ip || user_agent)The salt rotates at 00:00 UTC per site. After hashing, the IP is dropped. A visitor who returns tomorrow is counted as new. Visitor hash.
What we cannot know
- Who a visitor is.
- Whether they returned after midnight UTC.
- Cross-site or cross-device identity.
- Exact address (city is optional and off by default).
- Anything about visitors who block the request entirely.
Source of truth
The machine-readable version is GET /api/sites/{domain}/manifest. The long-form document is `docs/privacy-model.md` in the repository. The marketing site's privacy page is the plain-language twin.
Something off? Open an issue · Edit on GitHub