Privacy-First Analytics: What It Actually Means
- Privacy-first analytics means counting visitors without storing anything that identifies a person. No cookies, no persistent device IDs, no raw IP addresses.
- Kymo builds a visitor identifier from a salted server-side hash that rotates at UTC midnight. Unique visitors are unique per day by design.
- AI crawler tracking is separate from human analytics. Crawler events do not count against your event limit, and crawler user-agents are kept on the crawler's own row for audit.
- You get standard analytics like pageviews, referrers, and bounce rate, plus a view of which AI assistants fetch your pages and send traffic back.
- The trade-off everyone skips: stricter privacy means "unique visitors" is a daily number, not a cross-device identity graph.
Privacy-first analytics means you get the numbers you need to run a site, without building a surveillance profile of the people who visit it. That is the whole definition. The rest is implementation detail, and the detail is where most "privacy-friendly" tools quietly cheat.
Why "no cookies" is the easy part
Dropping the cookie banner is table stakes. It does not make a tool privacy-first on its own. A tracker can be cookie-free and still fingerprint your browser, store your IP, and stitch together a history across sites. That is not privacy-first. That is privacy-washing.
Real privacy-first analytics has a simple test. If the vendor receives data that could identify a person after the fact, it is not privacy-first. It might be less invasive than Google Analytics, but it is holding enough data to hurt someone if it leaks.
Kymo fails that test on purpose, in your favour. No cookies. No localStorage for tracking. The visitor identifier is a salted server-side hash that rotates at UTC midnight. Raw IPs are never stored. No human visitor's user-agent string is ever stored. This is not a compromise to achieve privacy. It is the design.
The practical consequence is that "unique visitors" on Kymo means unique per day. The same person visiting at 9am and 9pm counts as one. Visiting yesterday and today counts as two. You are giving up the ability to obsess over a single individual's month-long journey in exchange for not being one more company holding that individual's data. Accept that trade and move on.
The data table every marketer should see
Here is how the two approaches stack up in practice:
| What is tracked | Cookie-based analytics | Privacy-first analytics |
|---|---|---|
| Persistent identifier | Yes, across weeks or months | No, rotates daily |
| Raw IP address | Often stored | Never stored |
| User-agent string | Stored for all visitors | Stored only for AI crawlers |
| Cross-device tracking | Possible | Impossible by design |
| Unique visitor definition | Long-term identity | Per-day count |
| Real-time active visitors | Yes | Yes |
The middle row matters more than people think. Kymo retains the user-agent of AI crawlers on the crawler's own event row so classification stays auditable. A crawler is not a person. A script crawling your site for training data has no privacy interest. Keeping that user-agent does not violate the privacy promise, and it lets you verify that the "AI crawler" row in your dashboard is actually what it claims to be.
How the cookie-free side of Kymo works
The analytics basics are the same ones you already know. Pageviews, unique visitors, referrers, top pages, countries, devices, browsers, sessions, bounce rate, session duration. A real-time map of active visitors. Outbound click tracking. Goal tracking, including revenue on a goal. UTM campaign tracking for source, medium, and campaign.
What is different is how the data is collected. The script sends an event to a server-side receiver. That receiver hashes the visitor data with a salt that changes daily. The output is a number that cannot be reversed to find the original visitor. It cannot be joined with other data to re-identify someone. It resets at midnight.
This is the correct trade-off for a small business. You do not need to know that "John from Chicago" visited your pricing page four times last week. You need to know that your pricing page got 400 visits and 38 clicks on the signup button. The first is creepy. The second is useful.
The Kymo documentation spells out exactly what the server stores and what it discards. If you are going to claim privacy-first to your customers, read it once so you can answer their questions.
The part nobody else tracks: AI crawlers
While human visitor data stays minimal, Kymo tracks AI crawlers in detail. A server-side receiver classifies crawler user agents into three categories:
- ai_answer: a live fetch made for one person's question. Examples include ChatGPT-User, Claude-User, Perplexity-User.
- indexing: search-index crawlers. Examples include OAI-SearchBot, Claude-SearchBot, PerplexityBot.
- training: bulk crawls for model training data. Examples include GPTBot and ClaudeBot.
AI crawler tracking does not count against your event limit. It is a separate stream of data. That means you can measure exactly what OAI-SearchBot is fetching from your site without burning a single event from your human analytics budget.
The three categories are not academic. They map to different outcomes. A training crawl is data collection. An indexing crawl is building a searchable memory of your site. An ai_answer fetch is live evidence that an assistant is reading your page right now to answer someone's question. The last one is the future of your discovery.
If you are new to the differences between these types, start with the AI crawlers section. It covers who is out there and why they behave differently.
The AI visibility report is where this gets practical
The AI Visibility report shows which of your pages AI assistants fetch, the likely prompts behind those fetches, and confirmed click-throughs from AI referrals. This is the part of Kymo that acts as a diagnostician. It shows you what is happening. It does not write content for you or do outreach.
You are not going to fix what you cannot see. If ChatGPT is fetching your FAQ page but never your product page, that is worth knowing. If Perplexity is citing you for one cluster of keywords but ignoring another, that is actionable. The What Is an AI Visibility Checker and Do You Need One? post walks through what these reports actually tell you.
You can even run a free AI visibility check without installing anything. It reads a URL from public signals only, so your site does not need Kymo installed. The report arrives by a magic link over email. Useful for auditing a competitor or checking your own site before you commit to a tool.
Search is changing. SEO still matters, but AI answers increasingly decide who gets found. The The Small Business Guide to AEO covers what answer engine optimization means for a site of your size. The short version is that you cannot improve what you do not measure.
Pricing, plain and simple
Both plans include every feature. The only difference is event volume.
- Solo: $9 a month, or $90 a year. Up to 10,000 events a month.
- Studio: $29 a month, or $290 a year. Up to 100,000 events a month.
Both plans start with 14 days free, no card required. AI crawler tracking does not count against your event limit. Exceed your event limit and the dashboard pauses. Your data is not deleted. You are not being punished. You just need to wait for the next cycle or upgrade.
This is simpler than GA4, cheaper than Semrush or Ahrefs, and broader than single-purpose AI trackers. It is built for solo builders and small teams who do not have an analyst.
The fine print nobody reads
If you block crawlers, you should know which ones you are blocking. [Google-Extended (a robots.txt control token, not a crawler)](https://kymo.in/crawlers/google-extended) controls whether Google uses your content to train Gemini. It does not stop Google Search indexing your site. Blocking it is safe for your SEO. [CCBot (Common Crawl)](https://kymo.in/crawlers/ccbot) is a wild card because Common Crawl data feeds multiple AI models. The AI crawler directory lists all of them so you can decide.
One decision point: the daily rotation of identifiers means your "bounce rate" and "session duration" metrics are computed from sessions that last at most one day. A visitor who arrives at 11pm and returns at 1am is two visitors. That is the privacy cost. It skews long-duration engagement numbers slightly downwards. It is the right trade.
Recommendation
Pick Kymo if you are a solo builder or small business owner who wants to keep an eye on both human traffic and AI discovery without spending a week learning a platform. The AI search for small business category explains why this matters for your particular situation.
Adopt privacy-first analytics if you are the kind of site that would have planted a cookie banner years ago and never thought about it again. You are already turning away visitors with that banner. Go further. Stop collecting their data entirely.
If you want to be prepared for AI search, do it if you are currently finding yourself mentioned in AI chats but have no way to verify it. The free AI visibility checker can tell you where you stand right now.
See your own visitation numbers
The fastest way to understand what changes when AI answers eat into your search traffic is to see your own data. Use Kymo to get both human and AI crawler analytics on one dashboard, or run the free AI visibility check first. It reads a URL from public signals so your site does not need Kymo installed, and the report arrives by email.