How circ works
What the tracker on your site sends, how readers are counted without cookies, and what happens to the data afterwards.
On your site
circ is one line in Ghost Admin's Site Footer code injection: a script tag pinned to one version of the tracker, with an integrity hash, so the browser refuses any other file. The dashboard generates the line from your settings.
On each page, the tracker sends one request when the page loads, and another when the reader leaves or switches away, carrying how far they scrolled and how long the page was in front of them. It has no heartbeats, loads nothing else, and never throws an error into your page.
circ reads your posts, authors and tags through Ghost's Content API, with a key from a custom integration. That key reads only what your site already publishes, and is stored encrypted.
What a pageview records
| Field | What's kept |
|---|---|
| Page | The path. Query strings are dropped, except campaign tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content and ref). |
| Referrer | The address and path of the page the reader came from, never its query string. |
| Time | When the pageview arrived, and the hour on the reader's own clock. |
| Scroll depth | How far through the story body, in steps of 10%. |
| Engaged time | How long the page was visible, up to 30 minutes. |
| Device | Device type, browser family and operating system family, worked out from the browser string, which is then dropped. Window width as one of four sizes. |
| Country | From the connection, never a more precise location. |
| Language | The browser's language and region, such as en-US. |
| Automated? | Whether the visit looks like a bot. Bots are kept out of every report. |
| Visitor code | A code for counting unique readers in a day, described below. |
Two optional features
Both are off until you turn them on in Settings and add them to your snippet. Neither side can turn one on alone, and the dashboard asks you to confirm your privacy policy covers a feature before it starts.
- Link clicks: the links clicked inside a story, as the link's address and its position in the post. A click carries nothing that ties it to a pageview or a reader, so clicks can't be strung into anyone's trail.
- Member status: whether the reader is signed out, a free member or a paid member, never which member. It needs one line in your theme, which prints only the status. Reports withhold any number under 5, so a handful of paid members can't be picked out.
How readers are counted
To count unique readers, circ turns the reader's IP address and browser string into a code, using a secret made for your site and that day. The IP address and browser string are then dropped.
- Each day's secret exists only in circ's key-value store, and is deleted about an hour after your site's day ends. circ keeps no copy, and the store gives no way to restore one, so nobody at circ, its operator included, can work a code back to an IP address, or link one day's codes to another's.
- So unique readers are counted per day. Weekly and monthly figures add up days, and are labelled that way. There are no returning-visitor counts: that's the trade for not recognising readers.
- Within a day, the code does group one reader's pageviews together. Reports show only totals, never one code's pageviews.
- Readers sharing one connection and the same browser, in an office or a library, count as one reader that day.
Never collected
Full IP addresses. Raw browser strings. Cookies, or anything stored on the device. Member IDs, emails or names. Form contents, keystrokes, mouse movement. Session recordings. Identifiers that follow a reader across sites, or from day to day.
Where it runs
circ runs on Cloudflare's network. Collection doesn't wait on anything else: if the reports are slow or down, pageviews are still accepted, and the reports catch up. Every event is kept as it arrived, so any report can be rebuilt from the events themselves.
Who can see your data
- Your people, through the dashboard, behind a sign-in. Each person sees only the sites they've been given.
- circ's operator, to run and support the service.
- Nobody else. Your data is in a database of its own, never combined with another publisher's, never sold or shared.
How long it's kept
For as long as your site uses circ: a publication's readership history keeps its value. When you stop, you can have an export of your database and raw events, and then they're deleted. The platform keeps a 30-day restore history of each database, so a deleted database can be recovered for up to 30 days, and is then gone.