Privacy-First Session Tracking
Three page views in a row are usually one person looking around. Knowing that is the difference between “forty views” and “eight visits”, and it is most of what a session is for.
Pushbroom does that, and does not do anything else with it.
What a visit is
When a visitor arrives, Pushbroom mints a random identifier and hands it to their browser. Page views recorded while the browser still has it are recorded as one visit. That is the whole mechanism.
The identifier is a random UUID. It is generated on our side, fresh, with nothing derived from the visitor — not their address, not their browser, not anything about their device. There is nothing in it to work backwards from, because it was not made out of anything.
Where it is kept
Not in a cookie. The tracking script sets none, and neither does the endpoint it talks to.
It rides in the browser’s own HTTP cache, as an ETag — the ordinary header a browser uses to ask “do I already have the current version of this?“. The browser holds the tag and offers it back on the next request, which is exactly the behaviour caching is for. We read it, recognise the visit, and hand the same tag back.
Its issue time travels inside the tag, so the server can tell how old a visit is without keeping a record of it anywhere.
Two hours, absolute
A visit lasts two hours from the moment it was minted, and the clock does not restart. Somebody reading for three hours gets a second visit rather than a rolling one that never ends.
After that the identifier is not renewed, and a returning visitor is a new visit with a new random identifier. There is no version of this that accumulates.
One site
A visit belongs to the site it was minted on, and subdomains are separate sites. A visit to example.com and a visit to shop.example.com are two visits with two unrelated identifiers, and nothing joins them — not for you, and not for us.
There is no shared identifier space across the sites Pushbroom measures. There is no mechanism here that could follow somebody from one site to another, so there is nothing to turn off.
A visit is not a person
This is the part worth being exact about.
A session is a bag of things that happened near each other. It says these views go together. It does not say who, and it is not joined to a profile, an account, an email address or a previous visit, because there is nothing to join it to. Pushbroom does not keep a record of visitors, so two visits by the same person are two visits, full stop.
That is a real limitation. You cannot ask Pushbroom how many people came back this month, and no amount of configuration will change that — the data to answer it was never collected. What you get instead is a number that means what it says.
If a visitor would rather not
A visitor can opt out, and a browser sending Global Privacy Control has opted out already. In either case no identifier is minted and nothing is stored — see opting out.
Last updated