Web analytics · no cookies · nothing of ours to consent to
Know how people
use your site.
Learn nothing
about them.
One script tag, 3.2 KB over the wire. No cookies, no local storage, no device identifier, no fingerprinting. There is nothing of ours for a consent banner to ask about.
Free software · AGPL-3.0 · self-host or hosted
The entire installation
<script defer
data-site="YOUR_SITE_KEY"
src="https://tastatur.dev/t.js">
</script>What you get for it
Visitors
1,842
↑ 12%
Pageviews
4,201
↑ 8%
Bounce
54%
↓ 3%
Top pages
Sources
0
cookies set or read
0
bytes written to the visitor's device
24h
before an identifier stops working
2
letters of location, the country code
How an anonymous visit is counted
01
A request arrives
Your visitor's browser sends the page path and referrer host. Their IP and user-agent arrive too, as they do with every HTTP request on the internet.
02
It becomes a digest
IP, user-agent and site are combined with a secret that changes daily into a truncated HMAC. The IP and user-agent are then discarded. Never logged, never stored.
03
The secret is destroyed
Every 24 hours the secret is replaced and the old one deleted from a store that never writes to disk. Yesterday's digests can no longer be recomputed by anyone, including us.
The cookie question
Two different things get called cookies. Here is exactly where each one applies.
On your visitors' devices
Nothing
No cookie is set and none is read. Nothing is written to localStorage, sessionStorage or IndexedDB. No identifier is stored on the device in any form. This is the part that determines whether you need a consent banner for Tastatur, and it is the promise the product is built around.
On this dashboard, for you
Up to three
A first-party session cookie, set when you sign in, so you stay signed in. A second if you tick "stay signed in". A third if you use two-factor authentication and ask us not to send a code to this browser every time. All strictly necessary for a login and exempt from consent on that basis. They are set on our site, for account holders, and never touch the sites you measure or the people who visit them.
We say this explicitly because "no cookies" is used loosely in this category. A login needs a session cookie; pretending otherwise would be nonsense rather than privacy. What matters is that nothing of ours reaches your visitors.
Still a real
analytics tool.
Privacy is a constraint on how the numbers are collected, not an excuse for having fewer of them.
Traffic over time
Visitors, pageviews and visits, bucketed by hour, day, week or month in your own timezone.
Funnels
Multi-step funnels with per-step drop-off, ordered correctly even when visitors backtrack.
Goals and revenue
Match a path or a custom event, with conversion rates against an honest denominator.
Sources and campaigns
Referrers grouped into recognisable sources, plus full utm_* campaign breakdowns.
Filter and drill down
Click any row to filter the whole dashboard. Filter state lives in the URL, so it stays shareable.
Shareable dashboards
Give a client or colleague a read-only link, optionally password-protected.
What we will not claim
Measuring without tracking has real costs. Here they are.
Returning visitors get counted again. Because the identifier expires daily, a 30-day visitor figure is the sum of 30 daily figures, not a count of distinct people. Any tool offering cross-day uniques without a banner is keeping something durable.
Small rows are hidden. Breakdown rows describing only a handful of visitors are withheld, because such a row can identify someone.
We will not promise you skip the banner. That depends on your jurisdiction and on every other script on your site. Tastatur stores nothing on your visitors' devices; the rest is your counsel's call, and Germany in particular is stricter than our competitors' marketing copy suggests.
What that looks like
The same person, three days running
Mon
a3f1…08c2
Tue
7b04…d19e
Wed
e52c…4a77
Reported as 3 visitors over three days, because the secret that produced Monday's identifier no longer exists.
Top pages
Visitors2 rows withheld (7 visitors) because each was seen by fewer than 25 visitors.