TapCub is live — analytics, insights and live chat, free on one platform
Help center

How does TapCub count visitors without cookies?

What replaces the cookie, and how the balanced and strict presets change how long a visitor is recognized.

Privacy and security1 min readLast updated Oct 28, 2026TapCub teamPart of Cookieless analytics and consent

Short answer

The script writes nothing to the browser — no cookie, no local storage. Visitors are separated by an HMAC of the IP address and user agent, combined with a salt. The address is used for that hash and for geography, then discarded; it is never stored on the event row.

A hash instead of a cookie

On the default tier, TapCub separates visitors with an HMAC of the IP address and user agent, combined with a salt. The script itself writes nothing to the browser. The address is used for that hash and for geography, then discarded — it is never stored on the event row.

Balanced vs strict

Two presets change how long the pseudonym lasts:

  • Balanced keeps a site-level salt, so a returning visitor can be recognized across days and “new vs returning” works.
  • Strict rotates the salt every day. Nobody is recognized across days; returning visitors are not reported.

Choose on ConfigurationSettingsPrivacy. Rows already stored are not rewritten when you switch.

Lower totals than a cookie tool usually mean it counted bots or multiple tabs; higher totals mean a banner blocked it. Trends match, totals do not — see why UV never matches.

Did this answer your question?

We use your answers to fix and expand this page.

See your data clearly. Find your growth.

Every click, backed by data. Install one line of code and see your first numbers in a minute.

No credit card · Free plans for analytics and chat · Cookieless analytics