Privacy model

The Tracera privacy model is one paragraph long. The rest of this page is why it works and how to defend it to a customer's legal team.

The paragraph

Tracera stores no cookies, no persistent identifiers, and no IP addresses. Visitor uniqueness is a daily-rotating salted hash that becomes mathematically unrecoverable after 24 hours. There is no third-party tracker, no advertising integration, and no cross-site profile. All processing happens in the EU.

The mechanism

For each incoming event we compute:

visitor_id = sha256_64(
    daily_salt    // rotates every 24h, destroyed at rotation
    || domain
    || client_ip  // never stored; in-memory only for this hash
    || user_agent
)

• daily_salt is a 256-bit value generated each midnight UTC. The previous day's salt is overwritten in memory and (if it ever touched disk during a process restart) wiped.
• client_ip is read from the TCP connection, used for this hash + a server-side country lookup, then discarded. It is never logged and never persisted.
• The output is truncated to 64 bits and stored on the event as visitor_id.

Why this isn't personal data

After 24 hours the salt is gone. Without the salt, recovering "which IP+UA produced this hash" requires brute-forcing a SHA-256 keyed-hash against an unknown 256-bit secret. That is not computationally feasible — not for a state-level adversary, not for us.

Under Recital 26 GDPR, data is anonymous if re-identification "by any means reasonably likely to be used" is not practicable. The daily-salt model meets that bar.

What we therefore do not need

• A cookie banner for visitors — nothing is stored in their browser, no PII is processed.
• An explicit consent capture mechanism — processing is not based on consent; it's anonymous statistical processing.
• A SCC for international transfer — data doesn't leave the EU.

What we still do

• Maintain a public privacy policy explaining the model (see tracera.eu/privacy).
• Provide a Data Processing Agreement to every customer on request.
• Log and surface every admin action via the audit log.
• Document our sub-processors and notify customers ahead of any change.

Defending the model

If a customer's legal counsel pushes back ("isn't a hash still personal data?"), the answer is:

1. A hash is personal data only if the recipient can re-identify the subject with reasonably likely means.
2. The daily salt is destroyed every 24 hours, so the recipient (us) cannot re-identify after 24 hours.
3. The salt is never given to third parties, so no one else can either.
4. Within a 24-hour window, the hash is technically pseudonymous — but we never associate it with a name, email, account, or device identifier on our side.

This is the same reasoning Plausible publishes; see their data policy for the long form.