Clickport is designed so that privacy is built into the architecture, not bolted on as a configuration option. This page explains exactly how Clickport handles visitor data, what is collected, what is not, and how the system works without cookies or personal identifiers.
Clickport never sets cookies. Not "optional" cookies. Not "strictly necessary" cookies. Zero cookies, period. The tracker also never writes to localStorage for tracking purposes.
Sessions use sessionStorage to store only the session ID for the current browser tab. This value is automatically cleared when the tab closes. Under the ePrivacy Directive, storage that is strictly necessary for the service the user requested is explicitly exempt from consent requirements.
The practical result: no consent banner needed. No cookie management platform. No conversion loss from visitors declining consent or closing popups. Your visitors see your content immediately.
sessionStorage under the key cp_sid. This ID is generated server-side on the first pageview and links subsequent events to the same session within the same tab. It cannot be used to track visitors across tabs, across sites, or across sessions.
Clickport identifies visitors without cookies, fingerprinting, or any persistent identifier. Instead, it generates a user_id using a one-way hash of four inputs combined into a single string:
These four values are concatenated and hashed into a numeric ID. The daily date component means this hash produces a completely different ID for the same visitor every day. There is no way to link Monday's visitor to Tuesday's visitor, even with full access to the database.
A session starts when a visitor opens a page and ends when they close the tab. There is no 30-minute inactivity timeout like Google Analytics. The session ID is stored in sessionStorage, which is scoped to a single browser tab and cleared on close. Each new tab starts a new session.
The visitor's IP address is used for exactly two purposes, then immediately discarded:
user_id described above.After these two operations, the IP is gone. There is no ip_address column in the ClickHouse database schema. The stored user_id is a numeric hash that cannot be reversed to recover the original IP.
Clickport collects the data you need for meaningful analytics without ever touching personal information. Here is the full list of what is and is not stored.
Referrer URLs are stripped of all query parameters before storage. If a visitor arrives from https://google.com/search?q=my+health+condition, only https://google.com/search is stored. The search query is never recorded.
Clickport automatically strips tracking parameters from page URLs before storing them. This includes UTM parameters (extracted separately for campaign attribution), Facebook Click IDs (fbclid), Google Click IDs (gclid), Microsoft Click IDs (msclkid), and other ad-tracking identifiers. The campaign data is preserved in dedicated UTM fields, but the raw click IDs that could be used for cross-site tracking are discarded.
Clickport never uses browser fingerprinting techniques. Device type, browser name, and operating system are determined solely from the standard User-Agent header that every browser sends with every request. There is no canvas rendering, WebGL probing, font enumeration, plugin detection, AudioContext analysis, or any other fingerprinting technique.
The ClickHouse database stores only aggregate-friendly data points. Here is what a session record looks like:
No field in the database can identify a specific person. You could publish the entire dataset and no visitor's identity would be compromised.
Beyond the architectural privacy guarantees, Clickport provides several controls for site owners who want additional protection.
localStorage.setItem('clickport_ignore', 'true') in your browser console to exclude yourselfYou can exclude specific IP addresses from tracking in your site settings. This is typically used to filter out your own visits or your team's traffic. The excluded IP check happens at ingestion time, before any data is written to the database.
The tracker checks for a clickport_ignore key in localStorage. If it is set to 'true', the tracker exits immediately without sending any data. This is useful for developers and site owners who want to exclude themselves without adding their IP.
Individual sessions can be viewed, flagged as bots, or deleted entirely from the Sessions panel in the dashboard. Deleting a session removes all associated events from the ClickHouse database.
All visitor analytics data is stored on a Hetzner server in Germany. It never leaves the European Union. The database engine is ClickHouse, running on the same server as the API.
Traditional analytics tools were built in an era before privacy regulations. Their architecture assumes cookies, persistent identifiers, and cross-site tracking. Retrofitting privacy onto these systems requires configuration, consent management, and legal documentation.
Clickport takes the opposite approach. Privacy constraints are baked into the data model itself. There is no configuration that could make Clickport collect personal data, because the system has no mechanism to do so.
| Clickport | Google Analytics | Matomo Cloud | |
|---|---|---|---|
| Cookie-free by default | ✓ | ✗ | ✗ |
| No consent banner needed | ✓ | ✗ | Optional |
| IP addresses never stored | ✓ | ✗ | Optional |
| No browser fingerprinting | ✓ | ✗ | ✓ |
| No cross-site tracking | ✓ | ✗ | ✓ |
| EU-hosted data | ✓ | ✗ | EU option |
| No data shared with third parties | ✓ | ✗ | ✓ |
| GDPR-compliant without configuration | ✓ | ✗ | Requires setup |
| Visitor data sub-processors | 0 | 5+ | Varies |
Clickport uses multi-layered bot detection to prevent automated traffic from polluting your analytics. All detection methods are privacy-preserving:
Blocked bot events are counted in aggregate statistics (the Bot Management panel) but no personal data about the blocked request is retained.
The Clickport tracker is approximately 2 KB in size (gzipped). It is open and readable. Here is what it does and does not do:
localStorage (it only reads the clickport_ignore flag).https://clickport.io/tracker.js at any time. There are no external dependencies, no bundled third-party scripts, and no obfuscation.
Clickport provides complete legal documentation for your compliance needs:
For a detailed technical analysis of GDPR compliance, including the legal basis for processing, data subject rights, and the specific GDPR articles that apply, see the GDPR Compliance documentation page.