How Hikr Works Under the Hood
A rigorous look at our edge-computed, privacy-preserving infrastructure that tracks engagement without identifiers, cookies, or persistent device profiles.
The Tag Reads and Never Writes
When a visitor loads a page containing our script, the lightweight tag reads exactly what is necessary to understand the interaction context: the current page path, the HTTP referrer header, a coarse viewport bucket representing screen dimensions, and the precise timestamp. Crucially, nothing on the device is ever consulted because nothing was ever put there. There are no local storage flags, no session tokens, no cookies dropped into browser storage, and no local device fingerprinting vectors executed against the underlying hardware. The tag acts purely as a read-only sensor observing the immediate HTTP request parameters without attempting to establish state. Because no identifier is planted on the device, subsequent page views from the same human cannot be linked together on the client side. The browser remains a clean slate across every navigation event, ensuring that the user's browsing history on your property stays completely fragmented from any past or future visits. This fundamental separation prevents persistent tracking by design, rendering client-side surveillance obsolete while still capturing the aggregate traffic metrics required to evaluate site performance effectively. Learn more about the implications of this approach by reading our guide on cookieless analytics.
The Request Is Hashed at the Edge
Once the read-only parameters leave the browser, they hit our globally distributed edge network. Here, raw inputs such as IP addresses and user agent strings are combined with a dynamic cryptographic salt before being passed through a strict one-way hashing function. This salt rotates automatically every 24 hours. Because the salt changes daily, the resulting hash keys become completely ephemeral and independent from one day to the next. Raw input strings are discarded immediately in memory before any data ever reaches persistent storage or disk. The resulting hash key cannot be reversed back into an IP address or user signature, nor can it be followed across different websites or across different calendar days. This architectural constraint ensures that even if our infrastructure were somehow compromised, no raw identifying data exists to be harvested or leaked. The edge processing model completely decouples the request from individual identity at the exact moment of ingestion, transforming ephemeral network signals into anonymous, mathematical aggregates before any data permanence is established. This mechanism forms the bedrock of our compliance posture.
Events Aggregate as Counts Against Dimensions
Within our storage layer, incoming hashed events are aggregated strictly as scalar counts against predefined categorical dimensions such as page paths, referrers, and country codes. There is no visitor table, no user profile database, and no ledger of individual human journeys. Without a table of users, there is simply no profile to export, no record to subpoena, and no personal data to leak in the event of an audit or security breach. This structural omission has distinct operational consequences for your reporting capabilities. Specifically, it means there is no cross-session stitching and no individual journey replay. You cannot follow a single simulated user through a multi-day conversion funnel or track their precise click-by-click path across multiple independent browsing sessions. Instead, you see high-fidelity aggregate movement patterns—how many total visitors arrived from a specific campaign, which landing pages performed best, and what percentage progressed to key conversion milestones—while preserving absolute mathematical anonymity for every individual involved in those counts. This trade-off is essential for true data minimization.
You Read It Back
Accessing your aggregated metrics is streamlined through multiple high-performance interfaces designed to fit into your existing engineering and marketing workflows. Whether you query our real-time web dashboard, fetch metrics programmatically via our robust HTTP API, or configure scheduled automated data exports to your data warehouse, the underlying data structures remain identical. You receive the exact same keys, the exact same deterministic shapes, and the same privacy-preserving aggregations regardless of your access method. There are no hidden transformations or delayed batch processing quirks that alter historical trends unpredictably. Every metric is computed consistently at the edge and made available instantly for your review. This empowers your team to make rapid, data-backed product and marketing decisions without waiting for batch jobs to finish or wrestling with complex data cleanup scripts. Combine these insights with sophisticated strategies like our approach to lead attribution to measure marketing ROI accurately without compromising visitor confidentiality.
The 24-Hour Salt Horizon
Understanding our rolling cryptographic window and what it enforces as a strict upper bound on temporal correlation.
What does the 24-hour salt horizon mean in practice for your day-to-day analytics? If a visitor arrives on your website today, leaves, and returns tomorrow, our system counts them as a brand new visitor. That is the deliberate, hard ceiling on identity tracking within our architecture—not an adjustable retention setting that can be raised or extended by toggling a configuration switch. By purging and rotating the cryptographic salt every single day, we make it mathematically impossible to track returning visitors across calendar days. While traditional analytics tools fight to maintain multi-week or multi-month persistent identifier chains to stitch together longitudinal user histories, we deliberately discard that capability. We believe that aggregate daily unique visitor counts provide more than enough strategic signal for conversion optimization and traffic monitoring, without requiring invasive long-term tracking mechanisms that violate user trust and regulatory boundaries.
The Accuracy Trade-off
An honest assessment of what you sacrifice and what you gain when adopting strict privacy-first measurement.
Every analytics architecture requires explicit trade-offs. With Hikr, what you lose is cross-session stitching and longitudinal user journey reconstruction; you cannot trace a single human's exact path over a three-week buying cycle. What you gain is the visitors a consent-gated tracker never sees at all: the ones who decline the banner, dismiss it, or leave before answering it. How large that group is depends entirely on your audience and your banner, which is why we quote no figure for it — yours is the only one that matters. Because nothing is written to the device and no consent gate stands in front of the tag, those visits are counted like any other. To truly understand how this impacts your specific metrics, we recommend running a fortnight of parallel observation where you compare your legacy platform alongside our edge telemetry. To read more about our foundational philosophy on web telemetry and privacy engineering, visit our architectural essays.
Data Collected vs Never Collected
Collected
- Page path and title
- Referrer domain
- Country, derived from IP then discarded
- Device class and viewport bucket
- UTM parameters you set
- Custom events you send
Never collected
- Cookies of any kind
- Full IP addresses at rest
- Canvas, font, or audio fingerprints
- Cross-site identifiers
- Names, emails, or form contents
- Anything persisted on the device
Hikr operates entirely at the network edge. No persistent cookies are written to user devices, and all ephemeral metrics are aggregated automatically without human profiling or cross-site tracking.