Grid Atlas counts visits so we know which pages are worth maintaining. We do it ourselves, in first-party code — there is no Google Analytics, no advertising pixel, no third-party tracker of any kind on this site, and no data is sold or shared for marketing.
What is collected by default
By default, no cookie is set and nothing is written to your device. For each visit we record:
- the pages you viewed, and how long each was actually in front of you (the timer pauses when the tab is in the background);
- your country and region, resolved from your IP address at the start of the visit;
- the website that linked you here — the host name only, e.g.
news.ycombinator.com, never the full URL; - broad device details: desktop / mobile / tablet, browser family, OS family.
To count you once rather than once per page, we need something that stays the same across your visit. Instead of a cookie, we compute a one-way hash of your IP address and browser user-agent together with a secret salt. That salt is randomly regenerated every day and deleted after 48 hours, which means that once the day turns over, the stored identifier cannot be traced back to an IP address by anyone — including us. Your IP address itself is used only in memory, for that hash and the country lookup, and is never written to our database.
Because this data cannot be linked to you as an identifiable person, it falls outside the GDPR's definition of personal data, and does not require your consent. The trade-off is real and deliberate: we genuinely cannot tell whether you came back tomorrow.
The optional cookie
If you clicked Allow on the banner, we set one first-party cookie,
ga_vid, holding a random identifier with no meaning outside this
site. It lets us distinguish returning readers from new ones, and lets us record
your city as well as your region. It expires after 12 months. A second cookie,
ga_consent, simply remembers your answer so we stop asking.
The legal basis for the optional cookie is your consent (GDPR Art. 6(1)(a) and the ePrivacy Directive). The anonymous baseline processes no personal data; insofar as the transient IP handling is processing at all, the basis is our legitimate interest in understanding traffic to our own site (Art. 6(1)(f)).
Signals we obey
If your browser sends Do Not Track or a Global Privacy Control
signal, we record nothing at all — not even the anonymous baseline. Requests
from bots and crawlers are discarded, and admin traffic is excluded.
Who else sees anything
Site data is stored with Supabase, our database provider. To turn an IP address into a country we make one lookup per visit against ipapi.co, which necessarily means your IP address is sent to that provider at that moment. Both are US-based, so this is a transfer outside the EEA. Neither receives anything else about you, and we keep no record of the IP once the lookup returns.
How long it is kept
Visit records are deleted automatically after 90 days. Daily hashing salts are deleted after 48 hours.
Your choices
You can change your mind at any time. Erasing your data deletes every visit record we hold that is linked to this browser, under both the cookie identifier and today's anonymous hash, and turns the optional cookie off.