Data Policy

GDPR, CCPA & Cookie-Law Compliant Web Analytics

Empalo Analytics helps you measure website activity — but we do it without collecting or storing any personal data or personally identifiable information (PII). We don’t rely on cookies, and everything is built to protect and respect your visitors’ privacy.

What We Collect & How We Use It

We never follow people across devices, websites, or apps. Data is limited to a single day, a single website, and a single device — meaning there’s no way to connect visits across different contexts.

Our focus is on showing you overall traffic trends, not tracking individuals. That’s why we don’t use cookies, don’t create persistent identifiers, and don’t collect or store any personal information. All insights are based on aggregated data only, with zero personal details.

Data point	Example	Comment
Page URL	https://your_web_site.com/home	We track the page URL of each page view on your website.
HTTP Referer	https://openai.com	We use the referrer string to show you the number of visitors referred to your website from links on other sites.
Operating System	Windows	We use this to show you what operating systems people use when visiting your website. We show the brand of the operating system and the version number. This is derived from the User-Agent HTTP header. The full User-Agent is discarded.
Browser	Chrome	We use this to show you what operating systems people use when visiting your website. We show the brand of the operating system. This is derived from the User-Agent HTTP header. The full User-Agent is discarded.
Country	United Kingdom	We use this to show you where users are located. We calculate possible country based on IP, language preferences and locales, all these values are discarded after calculation.
User score	86%	We calculate user score based on Javascript and HTTP fingerprint, discarding all test results after percentage calculation. Data used in calculation: User-Agent, IP, Graphics test result. We do not store full User-Agent, IP or Graphics test result.
User Id	1024192309591757552	We calculate user ID based on Javascript and HTTP fingerprint, discarding all unused results after ID calculation. ID is calculated with unique daily salt, so for each day 1 user will have different IDs. Data used in calculation: User-Agent, IP, Graphics test result, daily salt.
Spider	true\|false	We detect if this event is generated by Web Crawler or not using: IP, User-Agent. IP and User-Agent are discarded after calculation.
Mobile device	true\|false	We use this to show you what devices people use when visiting your website. Devices are categorized into desktop or mobile. This is derived from the User-Agent HTTP header. The full User-Agent is discarded.

How We Calculate Unique Visitors

Counting unique visitors is a key part of analytics, but at Empalo we believe it should never come at the expense of privacy. Our approach is designed to balance accurate insights with complete respect for your visitors.

We never create device-persistent identifiers, since those are considered personal data under GDPR. That means: no cookies, no browser cache, no local storage. We don’t store, retrieve, or extract anything from your visitors’ devices.

Instead, we work only with information that naturally comes with Javascript and each HTTP request: the IP address, User-Agent, and a small image hash. Using these, we generate a daily-changing identifier with a hashing process that includes a rotating salt:

hash(daily_salt + website_domain + ip_address + user_agent + image_hash)

This gives us a random number used solely to count unique visitors for the day. Importantly, the original IP addresses and User-Agents are never stored in our systems — not in logs, databases, or anywhere else.

Every 24 hours, old salts are automatically deleted, ensuring there’s no way to connect data across days. This also eliminates the risk of original IPs ever being exposed, even under brute-force attempts. In short, your visitors’ raw data is completely inaccessible — even to us.

Our testing shows this method is highly accurate for visitor counts — often as accurate as cookies, and in some cases even better, since many visitors block cookies entirely.

The trade-off? We don’t track people across days, which means we can’t provide retention metrics like New vs. Returning visitors. That’s a limitation we accept in exchange for stronger privacy protections.

Data ownership

When you use our service to track your website statistics, Empalo Analytics collects information about your visitors. You’re placing your trust in us with your site data, and we take that responsibility seriously. Your site data belongs to you and protecting it is a top priority.

With Empalo, you retain full ownership of your website data. While analytics are stored on our cloud servers when using our hosted service, you remain in complete control of your data and continue to own it entirely.

All rights, title, and ownership of your website data stay with you. We gain no rights over your data and will never sell or share it with any third parties.

Your website data is not shared with advertising companies or any other companies in general.
Your website data is not sent to any third-parties at all.
Your website data is not mined and harvested for personal and behavioral trends.
Your website data is not monetized.

You can choose to delete your account and delete your site stats at any time.

Once you delete your Empalo Analytics account or remove your site stats, all associated data will be permanently erased right away. This information cannot be recovered after deletion.

Last updated September 20, 2025