What a 1 KB analytics script actually sends

Most analytics tags are a small advertisement for themselves: tens of kilobytes, a tag manager, a second request for a config file. Ours is under 1 KB gzipped. You can read the whole file.

It sends the site public id, hostname, path (only five UTM tags survive), and document referrer. Optionally an event name if you call cfa('signup'). There is no client timestamp — the server stamps created_at. The beacon is POST JSON, so those fields are not sitting in a CDN access log. That is the client.

What the server adds

On the way in we parse the user-agent into browser, OS, and device. We mark obvious bots. We clean the referrer to origin + path. The host platform already knows a country, region, and city from the request; we store those labels, never the IP or coordinates.

To count one person once per day we HMAC the site, IP and user-agent with a pepper and a salt that we delete at midnight. Only the hash is stored. Tomorrow the salt is gone. Days cannot be joined. That is still processing of personal data. It is not a cookie, and it is not a profile. Recipe on /methodology.

What we refuse

No canvas fingerprint. No font list. No stored UUID. No session replay. If a feature needs a second beacon just to know how far someone scrolled, we skip it. The default script stays under 1 KB. Clicks are a second, opt-in file.