Skip to main content

How we count clicks

Plain-language methodology for Snipzr link analytics. See the Privacy Policy for the legal basis and the Link stats API for the data shape.

Clicks, not visitors​

We count clicks, not unique visitors. We deliberately do not compute unique-visitor numbers: doing it accurately needs either a cross-request identifier (which we refuse to create: no cookie, no fingerprint, no salted hash) or probabilistic math we consider not worth the privacy cost. So a number labelled "clicks" is clicks; in the dashboard it means human clicks unless stated otherwise.

Human, automated, and why​

Every request to a short link is counted. Each one is either a human click or one of three kinds of automated traffic, and every automated request is counted and shown separately with its reason, never silently dropped.

  • Human = all requests minus the three kinds below. This is the headline number.
  • Bots & link previews: automation that says what it is. Crawlers and search engines, the preview a chat or social app loads when your link is shared, scripts and command-line tools, uptime monitors, a browser prefetching a link nobody opened yet (Sec-Purpose / Purpose / X-Moz headers), HEAD checks, requests with no user agent, Outlook and Office checking a link in a message, and bots Cloudflare has verified.
  • AI assistants: ChatGPT, Claude, Perplexity, Mistral or Meta AI opening your link because their user asked them to. A person asked for it, but no person saw your page, so it is not a human click.
  • Suspected automated: a request that claims to be a browser but does not behave like one, or a pattern no person produces:
    • no browser language (Accept-Language), which every real browser sends;
    • loaded inside another page instead of opened (Sec-Fetch-Mode is not a navigation);
    • browser headers that contradict the browser it claims to be (fetch metadata, client hints, a full Chrome build number, an HTTP/1 connection), at least two of them;
    • a data-center network together with such a mismatch;
    • from one data-center network: a burst of clicks on one link within a second, many of one account's links opened within seconds (typical of email security scanners), or clicks at clockwork intervals.

What protects real people: a single mismatch never flags a click, a data-center network on its own never does, and neither does a proxy that changes only the network and the protocol. Privacy relays and corporate security gateways (iCloud Private Relay, Cloudflare WARP, Zscaler, Netskope, Cisco Umbrella) are never treated as data centers, and a burst from home or mobile networks is just a popular link.

This is a careful signal, not adversarial-grade: a script that imitates a browser well from a home network can still count as human. Don't use these numbers for billing or fraud decisions.

If your links go out in emails to company inboxes, you may see fewer human clicks here than in tools that count every request. That's usually email security scanners opening your links before your readers do, not lost clicks.

In a link's stats, the line under the click number opens the breakdown: each kind with its total and its reasons. The raw total (human plus automated) is available in the API and CSV export but kept out of the default dashboard view: an uptime monitor hitting a link shouldn't make "82 human clicks" look like "43,000".

What we keep​

Whether a click comes from a data center is worked out in the moment from the IP address and the network it belongs to, the same way the country is, and only that label is used; the IP address is never stored. The pattern checks keep short-lived counters per link and per network (seconds for bursts and sweeps, two hours for timing), never per visitor. No cookies, no fingerprints, no visitor identifiers.

Older data​

We don't recount past days. Clicks counted before we started recording reasons keep their original numbers, and any bots among them show up as "Earlier, reason not recorded".

Repeat clicks (debounce)​

Short-link redirects carry a short private-cache header (~90s), so a browser reloading the same link within about 90 seconds is typically served from its own cache and not re-counted. This debounces accidental double-clicks; it is not a per-visitor dedupe.

Time: everything is UTC​

Days and hours are UTC. A "day" is a UTC calendar day; the hourly view is a rolling last-24-hours histogram by UTC hour. The dashboard labels times as UTC so the chart, the "today" boundary and the live badge all agree regardless of your timezone.

Countries​

We show the country a click came from: country only, never city or precise location. The country is derived at our content-delivery provider's edge from the IP address; we never store the IP. When the country can't be determined it shows as Unknown.

Referrers: "Direct / unknown" and hosts only​

The referrer is where a click came from. We store the referring site's host only (e.g. reddit.com), never the full page URL. Modern browsers already trim cross-site referrers to the origin, so host-only loses almost nothing.

  • Direct / unknown means no referrer was sent, typical for clicks from apps, email, chat, and QR scans.
  • Other is a fold: to stay bounded and resist referrer-spam, we track at most 48 distinct referring hosts per link per day; beyond that, and for very small entries, hosts fold into "Other". (CSV export keeps every host.)

Devices, browsers, operating systems, languages​

Broad families only: desktop / mobile / tablet; chrome / safari / firefox; windows / android / ios / macos / linux; and the primary browser language (en, de, …). Derived from the user-agent and Accept-Language. No exact models or versions.

We split human clicks by source: a direct short-link click vs a QR scan (Snipzr QR codes resolve through a distinct path). This is the one dimension you can verify yourself: scan your own QR and watch it increment.

All-time vs the tracked era​

Per-day tracking started on a specific date. The link's all-time counter predates that, so we show the split honestly ("X total since creation (incl. automated); Y before per-day tracking began [date]"), and the big lifetime number never silently contradicts the detailed per-day view.

A link imported from another shortener can bring that service's click total. It is shown on its own line as that service's number and is never added to ours: we did not see those clicks, so we cannot tell people from bots among them, or say when and where they happened.

Retention​

Aggregate statistics are retained for up to 750 days (~25 months) for every plan. Your subscription tier changes only how far back you can view, not how long we keep the data. Asking for a longer window than your plan allows isn't an error; we show what your plan can read and tell you how many days are actually stored. Deleting a link or your account deletes its analytics.

Freshness​

Today's numbers are live: they merge already-consolidated data with the current day's in-flight counts. An hourly job consolidates previous hours into permanent storage; a same-day number may dip briefly while that job runs, then settle. If our analytics store is momentarily unreachable we show recent data labelled "recent data only" rather than a wrong zero.

What we deliberately don't do​

No cookies or device storage for analytics · no cross-site tracking · no visitor profiles · no unique identifiers · no city/precise location · no full referrer URLs · no per-click event log in the product · no selling or sharing of this data.