Privacy & data handling

How GhostPane measures traffic, and what it does and does not keep.

The short version

GhostPane sets nothing on the visitor's device — no cookie, no local storage, no device identifier of any kind. It does not build a profile of a person across days or across websites, and it shares nothing with any third party, because the data never leaves the operator's own infrastructure.

What is collected

For each pageview, the following is recorded:

• The page address (path and query string), and the host of the referring site — never the full referring URL, which can contain search terms or tokens.
• Country and region, resolved at the network edge. No finer location is requested or stored.
• Device type, browser and operating system, in broad categories.
• The browser's preferred language, as a two-letter code.
• Any UTM campaign parameters already present in the link.
• A timestamp, and how long the page was actually visible.

What is never collected

• No IP address is stored. It is used only as input to a one-way hash, described below, and then discarded with the request.
• No cookies, no local storage, no session storage, no device fingerprinting — no canvas, font, or audio probing.
• No form contents, no keystrokes, no session recording, no heatmaps.
• No cross-site identifiers, and no data sold, shared or sent to any advertising network.

How a visitor is recognised without a cookie

To tell whether two pageviews came from the same person, GhostPane computes a hash of the IP address and user-agent, salted with a secret that is different for every site and regenerated every day. The salt is derived at the moment of use and never written down.

The consequence is deliberate: within one day the same visitor produces the same identifier, so sessions and visitor counts are accurate. On the next day the salt has changed, so the same person produces a completely different identifier that cannot be linked to the previous one — not by the operator, and not by anyone who obtains the database. The identifier is also scoped per site, so the same person visiting two sites is two unrelated identifiers.

This is why a visitor who returns on several days is counted once per day. That is the most accurate figure this design can produce, and producing a more flattering one would require exactly the long-lived identifier the design exists to avoid.

Consent

Because nothing is stored on or read from the visitor's device, the rules that require consent for cookies and similar storage (in the EU, the ePrivacy Directive as implemented nationally) do not apply in the way they do to conventional analytics. Data protection law still applies to the processing itself, and the operator of this installation remains the controller for it. This page is a technical description, not legal advice — operators with a specific obligation should confirm their own position.

Retention

Two kinds of data are kept, on different schedules:

• Aggregate totals — rows of the form "on this day, this page had 412 views". These describe no individual and are kept indefinitely, since they are the historical record.
• Row-level pageviews — used only for filtered views in the dashboard, and carrying the daily-rotating pseudonymous identifier. These are deleted automatically after 60 days, and can be switched off entirely per site.

Where the data lives

In the operator's own Cloudflare account, in a D1 database and in per-site edge storage. Cloudflare acts as the infrastructure provider. No other processor is involved, and there is no GhostPane company holding a copy — this is software the operator runs, not a service they subscribe to.

Opting out

Setting ghostpane_ignore to 1 in a browser's local storage stops that browser being measured on any site running GhostPane. Standard tracker-blocking extensions and browser protections also block it, and it is not designed to evade them.

Requests about your data

Because the identifier is one-way, salted with a rotating secret, and never stored alongside anything identifying, it is not technically possible to locate the records belonging to a particular person — including on request. That is a property of the design rather than a policy: there is no key that would make such a lookup possible, for anyone. Requests about data held by a specific site should go to that site's operator.