Problem
The visitor-hash salt is the literal UTC date YYYY-MM-DD (app/Analytics/tracking.ts:28) — a public, predictable value, not a secret.
Why it matters (privacy-first)
This is acceptable because we never store the raw IP/UA (so there is nothing to brute-force against), but it is weaker than Fathom’s per-site secret salt. Any "how it works" copy must be honest about this; a rotating secret salt makes the story airtight.
Proposed fix
Generate a per-day (or per-site-per-day) random secret salt, store it server-side, rotate + delete at UTC midnight. Keep the 24h linkability window.
Priority: P2.
From the 2026-07-20 privacy-first competitive audit (vs. Plausible / Fathom / Simple Analytics / Umami).