alt Hacker NewsNice writeup and I really like the minimal aesthetic of your site!
On unique users: I wonder if there is a way to set this up to work similar to TelemetryDeck's double-hashing anonymization[1]. Did you look into that before deciding to go purely session-based?
[1]: https://telemetrydeck.com/docs/articles/anonymization-how-it...
Based on my understanding of the GPDR, this scheme wouldn't be anonymous, if the salt is stored anywhere. Using the salt(s) and the full list of all your users emails, you could find out which one matches the hash, thereby linking the analytics to the original PII. Of course that's a rather ridiculous idea, but AFAIK the GDPR doesn't put any qualifiers or limits on "it's not anonymous if the PII can be recovered with extra data".