Most analytics tools ask you to choose: track everything and deal with consent banners, or respect user privacy and lose most of your data to “reject all” clicks. We didn’t think that was a real choice, so Mitr is built to not need cookies in the first place.
The problem with cookie-based identity
Cookie-based analytics identifies a visitor by writing a token to their browser and reading it back on the next request. That’s a storage operation, and both the GDPR ePrivacy Directive and comparable laws elsewhere trigger a consent requirement specifically because something was written to or read from the user’s device. Once that requirement is triggered, sampling starts: every “reject” is a visitor you can’t count, and every browser’s tracking-prevention feature (ITP, ETP) chips away at whatever’s left.
What Mitr does instead
Mitr never writes anything to an anonymous visitor’s device. For anonymous traffic, a pseudonymous ID is derived server-side from signals already present in the request — IP address and user agent — then hashed and the IP is discarded. Nothing is stored or read on the client, so there’s no storage event to trigger a consent requirement.
When you do call identify() with a real user ID (an email, a database ID, whatever your app uses), that ID is hashed client-side with SHA-256 before it ever leaves the device. Our servers never see the raw identifier — only its hash.
The Mayabheda Privacy Proof
On the backend, we re-derive a pseudonymous visitor token using HMAC-SHA256, keyed with a secret that rotates every day at 00:00 UTC. That daily rotation matters: even if a token leaked, it can’t be re-derived or linked back to yesterday’s activity once the key has rotated. We call this the Mayabheda Privacy Proof — a three-step pipeline (raw signal → salted HMAC → anonymized token) that’s fully described on our Trust & Compliance page.
The result is real-time, unsampled event data on a TimescaleDB-backed pipeline — the same visibility you’d expect from GA4 — without asking anyone to click through a banner first.
If you want to see the architecture in more detail, including how per-visitor erasure and export work, the Trust & Compliance page has the full technical breakdown.