Analytics without a cookie banner

The claim, stated so you can check it: the agentsgym tracking script sets no cookies, stores no personal data, and therefore needs no consent banner for itself. If that were not true, this page would not exist — constraint pages are only worth writing when the product matches the constraint outright.

The mechanism

The problem every analytics tool has to solve is “was this the same person as ten minutes ago” without keeping something that identifies them. agentsgym’s answer:

visitor_id = sha256(daily_rotating_server_salt + project_id + ip + user_agent)

Then the IP is dropped. It exists in memory long enough to compute the hash and is never written to a row, a log line or an analytics record.

Three consequences fall out of that:

1. No cookie, no localStorage, no fingerprint stored. Nothing is written to the visitor’s device, so there is nothing to ask consent for.
2. The id dies every day. When the salt rotates, yesterday’s hash cannot be matched to today’s. That is why the product reports “new today” instead of “returning visitor over 30 days” — the honest version of that metric is not available, so it is not offered.
3. It cannot be joined across sites. The project id is inside the hash, so the same person on two agentsgym-tracked sites produces two unrelated ids.

What you install

<script defer src="https://api.agentsgym.com/t.js" data-key="YOUR_SITE_KEY"></script>

The beacon sends text/plain deliberately: application/json would force a CORS preflight, and navigator.sendBeacon cannot preflight — the beacon would silently never send. The ingest endpoint answers 204 to everything, including an unknown site key, because it runs on your site and must never surface an error there or leak whether a key exists.

What you give up

• No cross-day visitor journeys. You get pageviews, visitors, top paths and referrers per day.
• No goals, events or funnels. If you need those, use a dedicated analytics tool — Plausible is the honest recommendation, and it is cookieless as well.
• No user-level debugging. There is no user to look at, by design.

The limits of the claim

This page is about one script. It does not make your site consent-free:

• Ad and social pixels, embedded YouTube, chat widgets and A/B tools usually do require consent.
• Your own login cookies are a separate matter (strictly necessary cookies are their own category).
• Rules differ by jurisdiction and change. Nothing here is legal advice — it is a description of what the software does, precise enough that your lawyer can check it.

Why it is not negotiable for us

The no-personal-data property is the reason a founder can paste the tag without a consent conversation. That makes it a product constraint, not a feature flag: it cannot be relaxed later for a nicer retention chart. It is written into the app’s own engineering rules for exactly that reason.

Comparing the privacy-first tools? Plausible vs Fathom puts their published positions side by side.