Counting visits without following people
Learning which pages are read and which products are opened, without cookies, profiles or recordings: what we chose, what we gave up and what testing changed.
Context
To improve the site we needed a few plain answers: which pages are read, which product stories lead someone to open the product, and which contact channel people use. Most analytics setups answer those questions by default with much more than that: cookies, a profile per visitor, recorded sessions, every click captured.
Our question was the opposite of the default: how little can we collect and still learn what we need?
Decision
- No cookies, no profiles. Product analytics (PostHog, EU region) runs in cookieless mode and creates no person profiles. Nothing is stored in the visitor’s browser for analytics, and no identifier is shared with Ritubon, CollectionEve or any other NCJK site.
- Named events only. Besides page views, the site sends four events we chose on purpose: the Work page was viewed, a product story was viewed, a product was opened, a contact channel was opened. There is no automatic click capture, no session recording and no heatmap.
- Addresses without the details. Query strings and fragments are removed from page addresses before anything is sent, and client IP data is discarded in the project settings.
- A clear “no” is respected. When the browser sends Global Privacy Control or Do Not Track, the analytics code is not even downloaded.
- Only the real site counts. Events are sent only from ncjk.net itself. Local builds, previews and test builds never send anything.
- Country comes from elsewhere. Without cookies or IP data, the product analytics cannot tell countries apart. We kept Cloudflare Web Analytics, which already runs on the site, for that one view instead of collecting more.
All of this is written in the site’s Privacy Policy.
Evidence
An automated check of 33 points runs against a test build whose traffic never leaves the machine. Among them:
- no analytics keys in local storage, session storage or cookies after browsing;
- nothing loaded when Global Privacy Control or Do Not Track is on;
- nothing loaded on preview hosts;
- each event fires once per page, with only the agreed properties.
Reflection
Two problems appeared only in testing. Events from the automated test browser were silently dropped as bot traffic, so the test now behaves like an ordinary desktop browser. Page events could also be lost when someone moved to the next page quickly, so they are now sent immediately instead of being batched.
What we gave up: the numbers are a lower bound, because blockers and privacy signals are respected, and the data does not follow one person across visits. We accept that. The questions we need answered are about pages and products, not about people.