Private analytics, without the trackers.

A consent banner exists because of what a site puts on the machine in front of you. The rules ask for permission to store or read information there — a cookie, something in local storage, anything that persists after you leave. Turret's tracking stores nothing on the device, so there is nothing to ask permission for.

Visits are counted on the server, from the request itself: which page, which referrer, which campaign tag was on the link. To avoid counting one person five times in an afternoon, the request is reduced to a salted hash that is thrown away nightly and never stored in the raw.

That hash is still information about a visitor, so it belongs in your privacy notice like anything else. What it isn't is a tracker: it cannot follow anyone off your site, and it is gone by morning.

One stored event, in full

{
  "event_type": "page_view",
  "path": "/order/celebration-cakes",
  "referrer": "https://www.instagram.com/",
  "utm_source": "instagram",
  "utm_medium": "social",
  "utm_campaign": "spring-window",
  "session_id": "sha256(ip + user-agent + daily salt) → 9f2a…c41b",
  "created_at": "2026-02-27T09:14:22Z"
}

That is the whole record. There is no second table holding the parts that would name someone, because those parts were never collected.