mikhail@cyfrin:~$ ./analytics --public

Traffic

This site counts its own visitors. At this traffic volume the numbers are not the interesting part — the method is, so here it is alongside the evidence.

last 30 days rendered 2026-08-25 14:44 UTC

  • 252 views
  • 202 visitors
  • 216 bot views
  • 2026-08-07 counting since

A visitor is one identifier on one day. Two days of the same person count as two, which is why there is no returning-visitor number below.

views and visitors per day, UTC
dayviewsvisitorsdistribution
2026-07-2700
2026-07-2800
2026-07-2900
2026-07-3000
2026-07-3100
2026-08-0100
2026-08-0200
2026-08-0300
2026-08-0400
2026-08-0500
2026-08-0600
2026-08-072716
2026-08-081510
2026-08-0987
2026-08-1066
2026-08-112519
2026-08-1297
2026-08-13138
2026-08-142219
2026-08-1566
2026-08-16109
2026-08-172323
2026-08-181310
2026-08-191311
2026-08-201313
2026-08-2155
2026-08-222413
2026-08-2399
2026-08-2477
2026-08-2544
pages
pathviewssharedistribution
/20782.1%
/analytics259.9%
/links207.9%
where visits came from
sourceviewssharedistribution
Direct / private23593.3%
t.co156.0%
Other20.8%
countries
countryviewssharedistribution
US10140.1%
Other5120.2%
CA2811.1%
DE197.5%
SE187.1%
NL114.4%
FR104.0%
HK83.2%
GB62.4%
devices
deviceviewssharedistribution
desktop19276.2%
mobile5923.4%
Other10.4%

how it works

Nothing is stored on your device
No cookies, no localStorage, and no analytics script. The count happens at the edge, before this page is served, so an ad blocker changes nothing about what is recorded — and there is nothing on your machine to consent to.
The identifier expires at midnight
A visitor is a SHA-256 of a random 32-byte daily salt plus host, IP address and user agent. The raw IP is never written down. The salt is generated once per UTC day and destroyed when the day rolls over, so yesterday’s identifiers cannot be recomputed by anyone — me included.
Which means returning visitors are uncountable
The same person on two days is two unrelated identifiers. There is no way to join them, so there is no returning-visitor number here. That is a consequence of the design, not an omission.
Small numbers are collapsed before they leave the database
Any bucket with fewer than five views is folded into “Other”, and that happens in SQL — a suppressed value never reaches this page in any form. At this traffic volume, an unsuppressed public dashboard would just be publishing individual browsing sessions.
Referrers are checked against an allowlist
A referrer is reduced to its registrable domain and reported only if that domain is somewhere already public. Everything else — including anything unrecognised — is reported as “Direct / private”, because raw referrers can carry links to private wikis, workspaces and hiring systems.
One SvelteKit app, one Postgres, no vendor
Vercel edge middleware writes one row per pageview through Neon’s HTTP driver. This page is regenerated at most once an hour, which is what keeps an unauthenticated public dashboard from being a free SQL endpoint.

what these numbers are not

  • Time is never reported finer than one day, and there is no live feed.
  • These dimensions cannot be cross-filtered, on purpose.
  • Bot detection is best-effort pattern matching. Some crawlers are counted as people and some people are counted as crawlers.
  • No identifier is retained past 30 days. That is the specific claim — the event log itself is kept, and referrer URLs are kept with it, visible only to me.