◆ Trust & Security
What we actually store.
Not a marketing summary — a direct accounting of every field that reaches our database, pulled straight from the code that runs in production. Last reviewed October 30, 2026.
The complete field list
Every visitor hit we record has exactly these fields. There is no hidden column, no separate raw-data table, no export that includes more than this.
Zero-knowledge authentication
Your access key is generated in your browser and never transmitted — not even during sign up. We only ever receive a one-way cryptographic commitment derived from it (a PBKDF2 hash, salted with a nonce). If our database were ever fully exposed, there would be nothing in it that could be turned back into your key.
How visitor hashing works
Instead of storing a visitor's IP address, we compute a one-way hash at the moment of the request and discard the input:
ip_address + user_agent + today's_date + site_key + salt
)
Because the calendar date is baked into the hash, the same visitor produces a different hash every day — there's no stable identifier to connect their visits over time or across sites.
Bot and spam filtering
Known bots, crawlers, and referrer-spam domains are matched against a maintained list before a hit is ever written — so your numbers reflect real visitors, not scraper noise. Requests are accepted with a normal response either way, so this filtering can't be probed or reverse-engineered from the outside.
Warrant canary
As of October 30, 2026, Pvtlytics has never received a national security letter, a gag order, or any court order compelling us to alter our systems or hand over user data — and has never been required to grant a third party direct access to our servers or database.
This statement is reviewed and republished on a regular basis. Its absence or unexplained removal should be taken as a signal, not an accident.