mikhail@cyfrin:~$ ./analytics --public

Traffic

This site counts its own visitors. At this traffic volume the numbers are not the interesting part — the method is, so here it is alongside the evidence.

last 30 days rendered 2026-10-10 18:28 UTC

  • 1708 views
  • 1276 visitors
  • 397 bot views
  • 2026-08-07 counting since

A visitor is one identifier on one day. Two days of the same person count as two, which is why there is no returning-visitor number below.

views and visitors per day, UTC
dayviewsvisitorsdistribution
2026-09-114239
2026-09-124742
2026-09-134441
2026-09-144239
2026-09-154944
2026-09-164239
2026-09-176054
2026-09-184539
2026-09-197844
2026-09-204436
2026-09-215039
2026-09-224841
2026-09-233833
2026-09-245548
2026-09-254136
2026-09-265146
2026-09-274337
2026-09-28315104
2026-09-294843
2026-09-3010250
2026-10-016453
2026-10-025141
2026-10-034739
2026-10-043834
2026-10-053231
2026-10-063432
2026-10-073331
2026-10-084443
2026-10-093938
2026-10-103432
pages
pathviewssharedistribution
/162595.1%
/analytics422.5%
/links412.4%
where visits came from
sourceviewssharedistribution
Direct / private169098.9%
google.com90.5%
t.co70.4%
Other20.1%
countries
countryviewssharedistribution
US75544.2%
DE1408.2%
SG1156.7%
CN1116.5%
HK724.2%
KR533.1%
BR523.0%
NL492.9%
Other492.9%
JP482.8%
GB422.5%
CA331.9%
LT311.8%
FR291.7%
SE251.5%
TH221.3%
PL191.1%
ID181.1%
IN140.8%
BE120.7%
ES80.5%
IE60.4%
AE50.3%
devices
deviceviewssharedistribution
mobile113366.3%
desktop57033.4%
Other50.3%

how it works

Nothing is stored on your device
No cookies, no localStorage, and no analytics script. The count happens at the edge, before this page is served, so an ad blocker changes nothing about what is recorded — and there is nothing on your machine to consent to.
The identifier expires at midnight
A visitor is a SHA-256 of a random 32-byte daily salt plus host, IP address and user agent. The raw IP is never written down. The salt is generated once per UTC day and destroyed when the day rolls over, so yesterday’s identifiers cannot be recomputed by anyone — me included.
Which means returning visitors are uncountable
The same person on two days is two unrelated identifiers. There is no way to join them, so there is no returning-visitor number here. That is a consequence of the design, not an omission.
Small numbers are collapsed before they leave the database
Any bucket with fewer than five views is folded into “Other”, and that happens in SQL — a suppressed value never reaches this page in any form. At this traffic volume, an unsuppressed public dashboard would just be publishing individual browsing sessions.
Referrers are checked against an allowlist
A referrer is reduced to its registrable domain and reported only if that domain is somewhere already public. Everything else — including anything unrecognised — is reported as “Direct / private”, because raw referrers can carry links to private wikis, workspaces and hiring systems.
One SvelteKit app, one Postgres, no vendor
Vercel edge middleware writes one row per pageview through Neon’s HTTP driver. This page is regenerated at most once an hour, which is what keeps an unauthenticated public dashboard from being a free SQL endpoint.

what these numbers are not

  • Time is never reported finer than one day, and there is no live feed.
  • These dimensions cannot be cross-filtered, on purpose.
  • Bot detection is best-effort pattern matching. Some crawlers are counted as people and some people are counted as crawlers.
  • No identifier is retained past 30 days. That is the specific claim — the event log itself is kept, and referrer URLs are kept with it, visible only to me.