Countries
The Countries card on the board shows how your page views are distributed across the countries where requests originated, using the two-letter ISO 3166 country code inferred from the request at collection time. The IP address itself is never stored.
How countries are determined
When a beacon request arrives at the StatelessID collector, the system looks up the country associated with the request's IP address using a local geographic database. The country code — two uppercase letters, such as US or DE — is written to the daily aggregate. The IP address is then discarded in the same request and never written to disk.
This lookup happens synchronously in the collection path, before the beacon is stored. If the lookup fails — because the IP is private, unknown, or not found in the database — the country is stored as an empty string and displayed on the board as (none). A visit attributed to (none) is a counted visit; it simply has no country assigned.
The geographic database used for the lookup is a periodically updated reference file shipped with the application. Country attribution is as accurate as that database for the time of the visit. Geolocation at the country level is generally reliable for non-VPN, non-proxy traffic, but VPN users and corporate proxy users may be attributed to the country of the VPN server rather than the country of the user.
Reading the Countries card
The card shows the top three countries by visit count for the selected range, with a horizontal bar proportional to share. Country codes are displayed in uppercase. (none) appears if an unknown-country row clears the privacy floor. Other groups all countries below the floor.
The compact view in the main board strip shows three rows. The collapsible drawer does not offer a longer countries list — the full breakdown is available in the CSV export, which includes all country rows above the privacy floor.
The distribution is by page view count, not by country. A single visitor who loads five pages in one session contributes five counts to their country row. A country with ten visitors who each load one page and a country with two visitors who each load five pages both contribute ten counts. The Countries card tells you where page views come from, not where visitors come from.
Country allowlist and filtered traffic
Your Filters settings include a country allowlist. When the allowlist is active, beacons from countries not on the list are dropped before counting and do not appear in the Countries card or the totals. Dropped country traffic is logged in the filter-impact panel as country allowlist drops.
With no allowlist configured — the default — all countries are accepted and appear on the Countries card. If you activate the allowlist and set it to a specific set of countries, the Countries card will only show those countries, and all other traffic will be counted in the filter-impact panel under country drops.
The allowlist is useful for sites that only serve a specific region and want to exclude traffic from outside that region from their quota count. It is not a security measure — it only affects counting. Beacons from excluded countries still reach the server; they are simply not counted.
VPNs and proxy traffic
VPN users are typically attributed to the country of the VPN exit node, not the country where the user is physically located. Corporate proxy users are attributed to the country of the proxy server. This means the Countries card may overcount some countries — usually the US, Netherlands, Germany, and Singapore, which host many VPN and proxy services — and undercount others.
There is no reliable way to detect or correct for VPN and proxy attribution using server-side IP geolocation alone. The counts you see in the Countries card are the best estimate available from the IP address at collection time. Do not treat them as a precise census of where your visitors physically are.
Privacy and country data
The country code stored per page view is a coarse signal. A two-letter country code covers tens of millions or hundreds of millions of people. It cannot identify a visitor, a city, a postal code, or a neighbourhood. StatelessID intentionally does not look up city or region data — country is the only geographic level stored.
Because the IP address is discarded at collection time and not stored in any form, it is not possible to trace a stored aggregate row back to a specific IP address. The aggregate count for a country in a date range cannot be disaggregated into individual visits after the fact.
Troubleshooting
If a country you expect appears as (none), the geographic lookup for that IP range may be returning an unknown result. This is common for traffic from private-network IPs (10.x.x.x, 192.168.x.x), localhost, and some cloud-provider ranges. There is no configuration option to fix this; (none) is the correct label for visits whose country cannot be determined.
If you have activated the country allowlist and the Countries card is empty, confirm that the countries you added to the allowlist are spelled correctly using two-letter ISO 3166 codes (uppercase). An incorrectly entered code will cause all traffic to be dropped.