Cookieless · No IP stored · No banner

Privacy-first web site analytics tool

A fast-loading embedded web analytics tool to help you track realtime visitors, view click heatmaps and watch visitor session replays, with no pop-up cookie warning banner — helping you retain visitors and analyse your web traffic.

Free for 30 days. Card up front, charged on day 31 unless you cancel — one click, any time. See the whole price ladder.

  • 0IPs stored
  • 1270BScript size
  • 30dTrial, cancel any time
Click & scroll heatmaps
Click density — /pricing 13,140 clicks · 7 days
Cold Hot
Most clicked elements on the pricing page over seven days
Element Clicks Share
button.plan-cta[data-plan="growth"] 4,128 31.4%
button#billing-toggle 2,610 19.9%
a.plan-cta[data-plan="starter"] 1,944 14.8%
h2.pricing-headline Dead 1,187 9.0%
a.nav-cta 903 6.9%
Masked session replay
Session 8f2a·41c9 — 4 pages, 2m 18s Masked
shop.example.com/checkout ••••••••••••••••• MASKED •••• •••• •••• •••• ••/•• ••• Complete order
2:18
  • Masked by default. Every form field on the page is redacted in the browser, before anything is sent. You turn individual fields back on one at a time, deliberately.
  • Never recorded: keystrokes, clipboard contents, file pickers, or anything inside an area you have marked private.
Realtime dashboard

Visitors

48,912

up 12.4 percent vs prev 30d vs prev 30d
  1. 210
  2. 244
  3. 231
  4. 288
  5. 302
  6. 279
  7. 341
  8. 366
  9. 352
  10. 408
  11. 441
  12. 470

Pageviews

131,408

up 9.1 percent vs prev 30d vs prev 30d
  1. 540
  2. 602
  3. 588
  4. 671
  5. 704
  6. 690
  7. 782
  8. 812
  9. 796
  10. 901
  11. 962
  12. 1,014
Visitors by country & city
Visitors by region 66,910 visitors · 30 days

Brazil 1,403

São Paulo 407

Geography

Down to the city they arrived from

Every visit carries a country and a city — with no IP address stored to work it out.

Visitors by region 66,910 visitors · 30 days

Brazil 1,403

São Paulo 407

Included from Growth

See where people actually click

Click, scroll and attention maps for every page, from the script you already pasted.

What the maps show you
  • Dead clicks — the headings and images people think are buttons.
  • How far down the page anyone ever gets, by device.
  • Any map segmented by source, country, device or campaign.
  • Aggregated across visitors. No individual is ever singled out.

$14 a month, included from Growth with nothing extra to buy.

How heatmaps work
Click density — /pricing 13,140 clicks · 7 days
Cold Hot
Most clicked elements on the pricing page over seven days
Element Clicks Share
button.plan-cta[data-plan="growth"] 4,128 31.4%
button#billing-toggle 2,610 19.9%
a.plan-cta[data-plan="starter"] 1,944 14.8%
h2.pricing-headline Dead 1,187 9.0%
a.nav-cta 903 6.9%

Add-on Session replay

Watch the session. Never read the data.

Every form field is masked in the browser — not redacted on our servers, never sent.

What is and is not recorded
  • Masked by default. You opt individual fields back in, not out.
  • Keystrokes, clipboard contents and file pickers are never recorded.
  • Jump straight to rage clicks, dead clicks and JavaScript errors.
  • Delete any recording, or all of them, in one click.

From $19 a month, priced by your rung, with an allowance that scales with it.

How masking works
Session 8f2a·41c9 — 4 pages, 2m 18s Masked
shop.example.com/checkout ••••••••••••••••• MASKED •••• •••• •••• •••• ••/•• ••• Complete order
2:18
  • Masked by default. Every form field on the page is redacted in the browser, before anything is sent. You turn individual fields back on one at a time, deliberately.
  • Never recorded: keystrokes, clipboard contents, file pickers, or anything inside an area you have marked private.

The dashboard

Three numbers that actually matter

Who came, what they read, and whether they stayed. One screen.

Unique visitors

48,912

up 12.4 percent vs prev 30d vs prev 30d
  1. 210
  2. 244
  3. 231
  4. 288
  5. 302
  6. 279
  7. 341
  8. 366
  9. 352
  10. 408
  11. 441
  12. 470

Counted with a daily-rotating hash, never a cookie.

Pageviews

131,408

up 9.1 percent vs prev 30d vs prev 30d
  1. 540
  2. 602
  3. 588
  4. 671
  5. 704
  6. 690
  7. 782
  8. 812
  9. 796
  10. 901
  11. 962
  12. 1,014

Bots and AI crawlers already removed, and never billed.

Visit duration

2:41

down 3.2 percent vs prev 30d vs prev 30d
  1. 178
  2. 172
  3. 181
  4. 169
  5. 174
  6. 166
  7. 171
  8. 163
  9. 168
  10. 159
  11. 162
  12. 161

Averaged across visits, from first event to last.

Top sources Visitors
  • Google organic 12,640
  • Hacker News referral 8,915
  • Direct / none 7,402
  • X social 3,118
  • GitHub referral 2,204
  • Reddit social 1,690
Top pages Pageviews
  • /pricing 18,402
  • / 14,918
  • /docs/install 9,734
  • /session-replay 4,881
  • /heatmaps 3,902

Reports

See exactly which step loses the sale

Build a funnel from your own goals and watch the conversion rate, step by step.

Which plans have this

Goals and saved segments come with every plan. Funnels, user journeys and the Stats API are on Business.

Checkout funnel — last 30 days 6.6% overall conversion
  1. 01 Landing page 18,402
    100.0%
  2. 02 Add to cart 4,118
    22.4%

    14,284 left here −77.6%

  3. 03 Successful checkout 1,214
    6.6%

    2,904 left here −70.5%

Checkout funnel — last 30 days
Step Visitors Share of entries Drop-off from previous step
Landing page 18,402 100.0% 0.0%
Add to cart 4,118 22.4% 77.6%
Successful checkout 1,214 6.6% 70.5%

The meter

You are billed for people, not for crawlers

A large share of what arrives at a site is automated. None of it reaches your bill.

What counts as automated

Declared crawlers, headless browsers, scrapers from datacentre ranges, and link previews nobody saw. Every one is filtered before it is counted, so it never reaches your dashboard either. Tools that meter raw hits charge you for all of it.

How the ingest filter works 5 layers
FILTER COUNTED AS PAGEVIEWS DISCARDED, NOT BILLED EVERY REQUEST
What the filter checks, in order
Checked
Declared crawlers and AI agents GPTBot, ClaudeBot, Googlebot, Bytespider and 63 more user-agent signatures
Self-identifying automation Headless Chrome, Puppeteer, Playwright, Selenium, curl, wget and the HTTP clients
Cloudflare's verified-bot list Taken as authoritative when the edge has already classified the request
A decisive Cloudflare bot score Only 1–5 out of 99. The middle of that range is too noisy to delete a visitor on
No user agent, or one too short to be a browser Under eight characters is not a browser, whatever else it might be

Filtered requests never reach your plan's pageview count. You are not billed for a crawler that read your site on an AI company's behalf. The filter errs the other way on purpose: 10 browser strings are protected from it by name, because a false positive deletes a real visitor from your numbers and you would never see it happen.

Setup

The whole install is one line of HTML

Paste it in your <head>. The first pageview lands before you switch tabs.

What you do not have to do

No npm package, no build step, no tag manager, and no consent flow to wire up.

01 Paste this once
<script defer  src="https://cdn.absolutelyanalytics.com/aa.js"  data-domain="example.com"></script>
1270 bytes gzipped No build step · no npm · no cookie banner
02 Verified Listening…
  • Served from 330+ edge locations 18ms p50
  • First pageview received no cookie set
  • Bot and AI-crawler filter armed 67 signatures
  • IP seen in memory, never written token rotates daily
03 Data, immediately Today

1,284

Pageviews since you pasted it

Pricing

Pick your traffic, then pick your tier

The cell where the two meet is your price.

How the allowance works

Pageviews and custom events share one allowance, and a month you go over never closes your dashboard.

Monthly pageviews and custom events

  • 10M+

Your allowance counts pageviews and custom events together. Bots and AI crawlers are filtered out before counting, so you are never billed for them.

Prices are in US dollars and exclude VAT. Where VAT applies it is added at checkout, and you can enter a business VAT number there.

  • Starter

    $9 /mo

    10k pageviews and custom events a month

    One site, one person, every core report.

    • Sites 1 site
    • Team 1 member
    • Retention 15 months
    • Adds
    • Live dashboard with every core report
    • Realtime visitor view
    • Goals and conversions
    • Email and Slack reports
    • Traffic spike alerts
    • Annotations on the timeline
    • Google Search Console integration
    • Google Analytics importer
    • CSV export
    Start 30-day trial
  • Business

    $19 /mo

    10k pageviews and custom events a month

    Funnels, custom properties, revenue and the Stats API.

    • Sites 10 sites
    • Team 10 members
    • Retention 15 months
    • Adds
    • Funnels
    • User journeys
    • Custom properties on events
    • Ecommerce revenue attribution
    • Stats API
    Start 30-day trial

Free for 30 days. Card up front, charged on day 31 unless you cancel — one click, any time. The trial is of the exact cell you chose: the same reports, the same allowance, the same price waiting at the end of it. Cancel and your dashboard closes; collection carries on and your history is still there the day you come back.

How it works

We could not identify your visitors if we wanted to

The IP address is read once, in memory, and is gone before the reply is sent.

01 Seen in memory, for one request

  • IP address 203.0.113.42 local variable, one request
  • User agent Mozilla/5.0 (Macintosh… never stored raw

02 One-way function

One‑way hash Not reversible. Not a lookup.

03 All we keep

The day's token 9f3a71c4e0b58d2a6c81d4f7

An opaque token, scoped to one site for one day. Nothing links it to a person, to a device, to the same visitor tomorrow, or to the same person on another site running this product.

04 Discarded before the response

  • 203.0.113.42never written
  • Mozilla/5.0 (Macintosh…parsed, then dropped

No IP address reaches a log, a database, an analytics pipeline or an object store. It exists as one local variable and goes out of scope with the request.

Every day, yesterday becomes unrecoverable

Tokens rotate daily, and the previous day's cannot be recomputed — not by us, not by anyone who obtained the database, not under a court order. So yesterday's visitors cannot be joined to today's. Cross-day tracking here is not switched off by policy; it is arithmetically impossible, which is the only kind of promise worth making.

Diagram: a visitor's IP address and user agent are seen only in memory during a single request and are discarded before the response is sent, never written to storage. What is kept is an opaque one-way token, scoped to one site for one day. The token rotates daily and the previous day's cannot be recomputed, so visitors cannot be linked across days, and it cannot be linked to the same person on any other site.

How cookieless analytics works, in full — what the word should mean, and the three things it costs you.

Questions

The things people ask before switching

Do I need a cookie banner?

No. We set no cookies and write nothing to localStorage except your own opt-out flag. There is no personal data to consent to, so GDPR and the ePrivacy Directive do not require a banner for our script.

How do you count returning visitors without a cookie?

With a one-way token that is scoped to one site and one day. The IP address and raw user agent are seen only in memory during a single request and are discarded before the response is sent — neither is ever written anywhere. The token rotates daily and the previous day’s cannot be recomputed, so yesterday’s visitors cannot be joined to today’s, and the same person on another site running this product is not the same token. Cross-day and cross-site tracking are not switched off by policy here; they are arithmetically impossible.

You can check the whole of that from your own browser: no cookie is set, nothing identifying is written to storage, and the entire request is readable in a network tab.

Do custom events count towards my plan?

Yes. Pageviews and custom events draw on the same allowance: a page load counts, and so does every event you send — outbound clicks, downloads, form submissions and 404s included. If you instrument heavily, work out your event volume before you pick a rung. What never counts is bot and AI-crawler traffic, which is filtered out before anything is metered.

What happens if I go over my plan?

Nothing breaks. We keep collecting and your dashboard keeps working. If you are over for three consecutive months we move you to the plan that fits, pro-rated, with 14 days’ notice and one click to decline. Traffic spikes, launches and AI crawlers are on us.

How big is the script?

1270 bytes gzipped, served from the edge nearest your visitor. Google’s gtag.js is roughly 145 KB — about 117 times larger, on every page load.

Is my data stored in the EU?

Yes, if you want it to be. Every account picks a jurisdiction at signup and the event store is created inside it — the choice is free and cannot be changed afterwards, because a stored region that can move is not a region.

Can I import my Google Analytics history?

Yes. The importer pulls your GA4 property through the Data API and backfills sessions, pageviews, sources and countries so your charts do not start at zero. It is included on every plan.

Ready

Paste one line. Watch the first visitor arrive.

A 1270-byte script, no cookie banner, and a dashboard that fits on one screen. 30 days on the plan you pick. A card is taken up front and charged when the trial ends, unless you cancel first.