Going further
Cookies & privacy
Two scripts, one API. Swap the filename to change the trade-off between attribution accuracy and storing anything on the device.
Which script
| numberhill.js | numberhill-cookieless.js | |
|---|---|---|
| Storage | one first-party cookie | nothing on the device |
| Visitor lifetime | up to 365 days | rotates at UTC midnight |
| Consent banner | usually required | usually not |
| Best for | considered purchases | content sites, EU-heavy traffic |
Cookie mode
numberhill.js stores a random 128-bit ID in the numberhill_visitor_id cookie — first-party, SameSite=Lax, Secure over HTTPS, expiry refreshed on each visit. Returning visitors are recognised for months, which is what makes long attribution windows accurate.
<script defer data-website-id="YOUR_SITE_ID"
src="https://numberhill.com/js/numberhill.js"></script>Cookieless mode
numberhill-cookieless.js derives the identifier in memory from coarse browser attributes plus the current UTC date. Nothing is written to the device, and because the date is part of the input the identifier rotates every 24 hours.
<script defer data-website-id="YOUR_SITE_ID"
src="https://numberhill.com/js/numberhill-cookieless.js"></script>The trade-off is real: a visitor who returns after two days looks like a new person, so multi-week attribution is less precise. For short consideration cycles that rarely matters.
Not legal advice
Whether you need a consent banner depends on your jurisdiction, your other trackers, and how you use the data. Confirm your specific setup with your own counsel — this page describes what the scripts do, not what your obligations are.What gets collected
- Path and hostname of the page, plus the referrer and any UTM parameters.
- Screen size and browser language.
- The browser's user-agent string, truncated to 256 characters. It is what distinguishes a customer from a crawler, so bot filtering is only honest if it is recorded.
- Country, resolved at the CDN edge — the IP address itself is never stored.
- The visitor and session IDs described above.
No visitor IP addresses, no fingerprint hashes beyond the cookieless identifier, and no cross-site tracking — NumberHill only ever sees traffic on the sites you install it on.
The one exception: crawler IPs
Hits already classified as bots store their source IP in the bot table. That address is the only way to tell a real GPTBot from something wearing its name, and a verdict with no evidence behind it is worth nothing — see bots & AI crawlers.
This is crawler infrastructure, not people: the address belongs to a datacentre operated by OpenAI, Google or whoever is impersonating them. Nothing on the human side of the product changes — events, which is what every visitor, conversion and revenue number is built from, still stores no IP at all.