Pulstracker is designed to meet and exceed the data minimisation and privacy-by-design principles of the GDPR. It applies strict technical safeguards, with no reliance on consent banners or intrusive identifiers, and offers fine-grained configurability.
Pulstracker processes a masked IP address in-memory, applies one-way anonymisation, and only then stores the result. This conforms with Article 4(5) (pseudonymisation) and Recital 26 of the GDPR, which notes that data is no longer considered personal if individuals are no longer identifiable.
We do not store full IP addresses, nor do we temporarily retain them in logs or memory for counting uniques. This approach ensures no personal data is ever persisted.
The User-Agent string is sanitised to store only browser;OS;device, discarding any specific versioning or fingerprinting potential. Referrers are also sanitised to retain only the top-level domain — not the full path, query string, or UTM parameters.
Pulstracker respects GPC signals, an emerging global standard recognised under CPRA §1798.135 and increasingly cited in GDPR-aligned jurisdictions. If a GPC signal is present in the user's request headers, Pulstracker disables tracking entirely for that session.
As of mid-2024, few leading analytics tools offer any formal GPC support.
Pulstracker is architected to offer meaningful insights without compromising user privacy. It does not require cookie banners or opt-in flows — because it doesn't need them.