This page describes how the plugin handles data. It isn’t legal advice: the consent or privacy notice you need depends on your site and where you are.
Nothing on visitors’ devices
Vireo sets no cookies and doesn’t use local storage for tracking. Nothing is stored on visitors’ devices.
How visitors are counted
Vireo combines a visitor’s IP address and browser with a secret that changes every day, and keeps only a scrambled result. Vireo keeps today’s and yesterday’s secrets and deletes older ones, so once a day’s secret is gone, nobody can work out which IP address a result came from, and a visitor can’t be followed from one day to the next.
What’s stored
- The raw IP address is written to a short-lived file while a view is processed, used to look up the country, and the file is deleted when the view reaches the database, usually within a minute. Raw IP addresses aren’t stored in the analytics tables.
- Country lookups are cached for 30 days under a keyed hash of the IP address, which can’t be reversed without your site’s secret key. The IP address itself isn’t stored.
- The records Vireo uses to tell visitors apart within a day are deleted after two days.
- Daily totals are kept for the period set under Settings, General, “Data retention”: 90 days, 180 days, 1 year, 2 years (the default), 5 years, or never purge.
All of it stays in your own WordPress database. Visitor data isn’t sent to RebelCode or anyone else.
Do Not Track and Global Privacy Control
Visitors who send Do Not Track or Global Privacy Control aren’t counted. This is on by default, with no setting, and it’s checked both in the browser and on your server.
Consent plugins
Vireo works with consent plugins that use the WP Consent API, such as Complianz, Cookiebot and Real Cookie Banner. It counts visits without waiting for consent by default. If you want it to wait for statistics consent, add this to your theme or a small plugin:
add_filter( 'vireo_require_consent', '__return_true' );The check runs in the browser, so it works with page caching.
Your privacy policy
Visitors can’t be identified, so there’s no per-person data to export or erase. It’s still good practice to mention in your privacy policy that you use Vireo Analytics and how it counts visits.
Outside services
Vireo only contacts outside services you choose to connect:
- WordPress.com, only while you run a Jetpack Stats import.
- Google, only while you run a Google Analytics import, and daily if you connect Search Console.
- DB-IP, only when you click the button to download the country database.
It also checks its own tracking address once an hour to make sure it still works. No visitor data goes to any of them.
Exporting
Settings, Import & export, Export CSV downloads site totals, pages, referrers, countries, devices, broken links or events for any date range.