FerrGrowth never stores a visitor's IP address. It stores a hash of the IP and the browser, so that unique visitors can be counted without a cookie. That hash used a fixed value built into the code. With a known value, anyone who could read the analytics table could try every IPv4 address and recover the visitor behind a row in minutes, which made the hash personal data rather than anonymous data.

The value is now a random salt, generated each day, shared by all servers, and deleted when it is two days old. It is kept in a part of the database that is never written to backups, so once it is gone, a hash from that day cannot be reproduced from anything we keep. Visitor counts within a day work as before. A visitor is still not followed from one day to the next.

Server-side events, which hash the visitor id your own code sends, are now keyed with a secret that never leaves the API, so they cannot be derived from the source either. Their identifiers change once with this release, so a visitor you tracked server-side shows up as new the first day.

Rows recorded before this release keep their old hashes until they are re-keyed, which we are doing separately.