No IP addresses stored

Locations without keeping addresses.

A visitor's IP address is used while their hit is handled, to work out where they are, to hold back floods and to apply your IP exclusions, and then dropped. It's never saved with your website's data.

Start free trial How it works

14-day free trial · No card required · From $9/month

What the address is used for.

Only while a hit is being handled, for four things:

Location: Country, region and city, with an approximate position for the map, worked out when a visit starts. Where nothing better is known, the browser's timezone gives the country.
Rate limits: Up to 120 hits a minute from one address to one website. The count is kept in memory, by address, and forgotten once the address goes quiet.
IP exclusions: Hits from addresses you exclude in Settings → Exclusions are dropped, and live chat isn't offered to them.
Cookieless mode: With cookieless mode on, the address goes into a one-way hash that recognises the visitor for one day. The hash is kept as the visitor id; the address isn't.

What is kept for a visit.

What the dashboard needs to show where visits came from, and no address:

Country, region, city and an approximate position for the map
Browser, operating system and device type, read from the user agent
Language, window size, referrer, campaign tags and the pages visited
A name and email only if you send them with identify or they come with a payment

The same on every way in.

Live chat and session recordings check the address against your IP exclusions and don't save it either, and neither does the ad-blocker proxy.

Through your own reverse proxy, SuprAnalytics sees the proxy's address instead of each visitor's, so locations can't come from the visitor's address. The managed proxy keeps the visitor's own.

How it works, in detail.

The docs page “GDPR and cookieless tracking” goes through it step by step.

How it works

Limits worth knowing

A location comes from the address at the moment of the visit, so a VPN or a mobile network can place someone in the wrong city or country
An IP exclusion only applies to hits that arrive after you add it, since past hits don't keep their address
In cookieless mode the day's visitor id is derived from the address and browser: it's pseudonymous, not anonymous
This is what SuprAnalytics stores. Whether your website needs consent depends on your jurisdiction and how you use the data; this isn't legal advice

Questions, answered.

Does SuprAnalytics store IP addresses?

No. The address is used while a hit is handled, for the location, rate limits and your IP exclusions, and isn't saved with the visit or anywhere else in your website's data.

Then how does it know where visitors are?

The country, region and city are worked out from the address when the visit starts, and only those are kept. If they can't be, the browser's timezone gives the country.

Can I still exclude my office's IP address?

Yes. Exclusions are checked as each hit arrives, so an exact address or a prefix like 203.0.113.* works without anything being stored.

Is a hash of the address stored instead?

Only in cookieless mode, as the visitor id: a one-way hash of a salt that changes every day (UTC), your website, the address and the user agent. With cookies, the visitor id is a random id made in the browser and has nothing to do with the address.

How is this different from cookieless mode?

They're separate. No IP addresses are stored in either mode. Cookieless mode is about the browser: no cookies and no ids kept on the device, with visitors recognised by the daily hash instead.

Does this make my website GDPR compliant?

Not storing addresses means less personal data held, but compliance depends on your whole setup and where you operate. Our privacy policy lists what is processed. This isn't legal advice.

More features

All features

See it on your own website.

Every feature is on every plan, with a free trial and no card.

Start free trial

14-day free trial · No card requiredPricingHow it worksAll features