We built a privacy-first analytics engine with zero cookies.
By eliminating cookies from the ground up, applications using Tracabit are 100% exempt from intrusive consent banners under GDPR and ePrivacy.
Traditional web analytics platforms were born in the advertising era. They rely on persistent client-side tracking cookies (such as _ga and _gid) to follow users across days, weeks, and domains. When privacy legislation like GDPR and the ePrivacy Directive emerged, the tech industry slapped invasive cookie consent banners over websites rather than fixing the underlying architecture.
At Tracabit, we took a clean-sheet approach. We asked: Can you provide actionable, granular product telemetry without setting a single cookie?
Under EU ePrivacy Directive Article 5(3), consent is strictly required when non-essential data is stored on or retrieved from a user's terminal equipment. Because Tracabit uses zero cookies and zero persistent localStorage tokens, websites instrumented exclusively with Tracabit are completely exempt from consent banner obligations.
To compute 30-minute session boundaries without cookies, our edge CDN nodes compute a daily mathematical hash combining client IP, User-Agent, and a cryptographic salt that rotates automatically at 00:00 UTC. The raw IP address is discarded immediately in memory after Geo-IP country extraction.
Event payloads are written asynchronously to compressed ClickHouse MergeTree tables, enabling sub-5ms aggregations across millions of rows with 98.4% lower hosting overhead than legacy SaaS platforms.
// Non-reversible daily passive session hash (RFC 9110 compliant)
export function computeDailySessionHash(
clientIp: string,
userAgent: string,
dailySalt: string
): string {
// Hash combining IP, User-Agent, and 24-hour rotating salt
const rawInput = `${clientIp}:${userAgent}:${dailySalt}`;
return djb2Hash(rawInput);
}Tracabit records traffic, events, crashes and web vitals with one script tag, and lets your coding agent read them over MCP.
Start free