How privacy works

Tidemark gets privacy from what it stores, not from a policy about what it might do later.

What is never stored

• IP addresses
• Raw user agent strings
• Cookies or local storage values on the visitor’s device
• Anything that follows a person from one day to the next

How a visitor is counted

When an event arrives, Tidemark computes:

visitor_id = HMAC-SHA256( site | IP | user agent , key = TIDEMARK_SALT (or APP_KEY) + today's UTC date )[0:32]

The hash is used to group hits into a visit and then kept as an opaque id. The IP and user agent are used for that calculation, for deriving location, browser and OS, and for shields, and are then discarded.

Because today’s date is part of the key, the same person gets a different id tomorrow. Old ids can’t be matched to new ones, and without the secret an id can’t be reversed.

What is stored

Per visit and event: the site, the opaque visitor id, timestamps, page path, hostname, referrer and source, UTM parameters, country, region and city (if geolocation is available), browser, operating system, device type and any custom properties you send.

What this means for your numbers

• A returning visitor on a different day counts as a new visitor.
• Visitors over a long range is a sum of daily uniques.
• You can’t look up an individual’s history.

Your data stays with you

On a self-hosted installation, data lives in your database on your server. The dashboard’s fonts, icons and map are self-hosted, so viewing it makes no third-party requests.

The one outbound request Tidemark makes is the update check, made about once a day and when an administrator opens Account settings → Updates: it asks GitHub for the latest release version and sends no site or visitor data. Set TIDEMARK_UPDATE_CHECK=false to turn the daily check off.

Retention

By default raw data is kept forever. Set TIDEMARK_RETENTION_DAYS to delete older data automatically. See Data retention.