arfarehman

<p>No Cookie Analytics – By Arfa tracks visits server-side without setting cookies in visitors’<br />
browsers. Data stays in your WordPress database with an admin dashboard, reports, and optional<br />
CSV export.</p>
<h3>Privacy</h3>
<p>This plugin stores analytics records in your WordPress database (<code>wp_ncaba_hits</code>), including:</p>
<ul>
<li>Page URL/path</li>
<li>Referrer host</li>
<li>Browser/OS/device type</li>
<li>Anonymized IP hash</li>
<li>Session key</li>
<li>Country code</li>
<li>Timestamp</li>
</ul>
<p>No raw IP address is stored in the plugin database.</p>
<p>Country detection behavior:</p>
<ol>
<li>Uses server-provided geolocation headers when available (for example Cloudflare or GeoIP<br />
headers).</li>
<li>Optional external IP geolocation lookup can be enabled by admin consent in plugin settings.</li>
</ol>
<p>When external geolocation is enabled, visitor IP is sent to:</p>
<ul>
<li>Service: <a href="https://ipapi.co/" rel="nofollow ugc">ipapi.co</a></li>
<li>Purpose: country lookup only</li>
</ul>
<p>Site owners must disclose this in their privacy policy before enabling external lookup.</p>
<h3>External services</h3>
<p>This plugin can optionally use the third-party service ipapi.co for country lookup. The lookup<br />
is <strong>disabled by default</strong> and only runs after a site administrator explicitly enables the<br />
“Allow External Geo Lookup” option in plugin settings.</p>
<ul>
<li>Service: ipapi.co (https://ipapi.co/)</li>
<li>What is sent: the visitor’s IP address (only when the option is enabled and no server-provided<br />
geo headers are available).</li>
<li>When: at most once per visitor IP per day; the resolved country code is then cached locally.</li>
<li>Why: to determine the visitor’s country code for the analytics dashboard.</li>
<li>Terms of Service: https://ipapi.co/terms/</li>
<li>Privacy Policy: https://ipapi.co/privacy/</li>
</ul>
<p>If the option is left disabled, the plugin never contacts ipapi.co.</p>
<h3>Features</h3>
<ul>
<li>Server-side tracking</li>
<li>GDPR-aware design (configure to your legal requirements)</li>
<li>No frontend cookies</li>
<li>Admin dashboard and home screen widget</li>
<li>Pages, Referrers, and Users reports</li>
<li>CSV export and settings import/export</li>
<li>Local bundled frontend assets (no CDN required)</li>
</ul>


No Cookie Analytics – By Arfa

Privacy-focused analytics with server-side tracking, dashboard reports, and no frontend cookies.

moovswell

<p>Snorklee Analytics is the official WordPress plugin for Snorklee — a privacy-first, 100% EU-sovereign web analytics service. The plugin auto-injects a single <code><script></code> tag on every public page of your site, with two modes :</p>
<h4>Standard mode (3rd-party)</h4>
<p>The classic snippet : <code><script defer src="https://snorklee.com/w.js" data-site="yoursite.com"></script></code>. Simple, lightweight, no server-side load. Drawback : Chrome 121+ in incognito mode and ad-blockers (uBlock Origin, Brave Shields, AdGuard) block requests to third-party “analytics” domains by default. Depending on your audience, <strong>5 to 20 % of sessions silently disappear</strong>.</p>
<h4>Self-host mode (1st-party — built-in proxy)</h4>
<p><strong>The killer feature.</strong> With one toggle, the plugin :</p>
<ol>
<li>Serves the tracker JS from your own domain via a WordPress route (<code>/js/flow.js</code>)</li>
<li>Proxies all events (<code>/api/event</code>, <code>/api/ping</code>, <code>/api/zone</code>, <code>/api/click</code>) through WordPress to snorklee.com</li>
<li>Caches the tracker JS for 1 hour using the WordPress Transients API (no extra DB load)</li>
<li>Forwards <code>X-Forwarded-For</code> so snorklee.com sees the visitor’s real IP for geolocation</li>
</ol>
<p>The visitor’s browser sees <strong>only 1st-party requests</strong> to your own domain. uBlock, Brave, AdGuard and Chrome’s Tracking Protection have nothing to filter. No DNS configuration. No Nginx tweak. No cPanel access required. <strong>Works on every WordPress hosting</strong>, including OVH/IONOS/Infomaniak shared plans.</p>
<h4>Privacy by construction</h4>
<ul>
<li>No cookie set on the visitor’s browser</li>
<li>No persistent identifier (visitor hash rotates daily, salt rotates monthly)</li>
<li>No cross-site tracking (each site has an isolated identifier space)</li>
<li>No advertising classification (no UTM parsing, no paid/organic split)</li>
<li>Honors <code>Do Not Track</code>, <code>Sec-GPC</code>, and a localStorage opt-out flag</li>
<li>Designed so that the ePrivacy consent requirement (article 5(3)) is <strong>not triggered</strong> : nothing is stored on or read from the visitor’s device — documented in the Snorklee compliance dossier</li>
</ul>
<h4>What the plugin does NOT do</h4>
<ul>
<li>No phone-home from PHP for visitor tracking in standard mode (everything happens client-side) — the only server-side call is the optional AI-crawler beacon described under “External services”, disabled with one toggle</li>
<li>No tracking pixel injected by the plugin itself</li>
<li>No data collection beyond what the standard Snorklee JS tracker does</li>
<li>No third-party scripts loaded</li>
<li>No SQL table created (the plugin only stores 3 options : domain, dashboard URL, self-host toggle)</li>
<li>No personal data stored on your WordPress server (in self-host mode, events transit through but are not logged)</li>
</ul>
<h4>Why use the plugin instead of pasting the snippet manually</h4>
<ul>
<li>Survives theme updates (the snippet sits in plugin code, not in <code>header.php</code>)</li>
<li>Settings page with built-in installation test (HTTP probe on home page)</li>
<li>Self-host mode in one click (impossible without writing PHP yourself)</li>
<li>Multisite-compatible</li>
<li>Clean uninstall : no leftover options, no SQL tables, no transient</li>
<li>MIT-licensed source code under 600 lines, fully auditable</li>
</ul>
<h3>External services</h3>
<p>This plugin connects to the Snorklee analytics service (https://snorklee.com), which is what it exists for. Three kinds of requests are involved :</p>
<ol>
<li><strong>Visitor tracking (standard mode)</strong> : the visitor’s browser loads the tracker from <code>snorklee.com/w.js</code> and sends pageview events to <code>snorklee.com/api/event</code>. Data sent : page path (query string stripped), referrer, viewport size, user agent. The visitor’s IP is used transiently for country/region geolocation and is never stored. No cookies, no persistent identifier.</li>
<li><strong>Visitor tracking (self-host mode)</strong> : same data, but the requests transit through your own WordPress site, which forwards them server-side to <code>snorklee.com</code>.</li>
<li><strong>AI-crawler beacon (server-side, optional, on by default)</strong> : when a known AI crawler (GPTBot, ClaudeBot, PerplexityBot…) requests a page, the plugin reports that crawl server-to-server to <code>snorklee.com/api/event</code> (crawler user agent + page path, query string stripped). This concerns bot traffic only, never your human visitors. One toggle on the settings page disables it.</li>
</ol>
<p>Service provider : Snorklee (France). Terms : https://snorklee.com/docs/en/gdpr · Privacy : https://snorklee.com/en/privacy-compliance · Data collected : https://snorklee.com/docs/en/data-collected</p>


Snorklee Analytics

Privacy-first, EU-sovereign analytics. No cookies, no consent banner. Built-in self-host mode that bypasses ad-blockers — no DNS or Nginx config.

No Cookie Analytics – By Arfa vs Snorklee Analytics