Features
Day one: paste one script. The visit after Reject is on the board — pageviews, sources, campaigns. Then whether the hostname answered. Named goals, Claude, and serving the file from your domain sit further down.
Sample dashboard, last 30 days
View sample dashboard
Unique visitors
1,493
Total visits
1,493
Total pageviews
3,036
Views per visit
2.03
Bounce rate
30%
Visit duration
5m 6s
Seeded sample — the same six tiles after the paste.
Start here. Growth funnels are a straight path on the same calendar day — midnight starts a new person. That is the privacy trade, not a hidden cap.
utm_source, medium, campaign, content, term. Everything else is dropped in the browser.
Only those five tags leave the tab. Tokens and emails in other query keys never reach us. Inner pages in a single-page app do not inherit the landing UTMs. The dashboard groups campaigns, channels, ads, and keywords. Messy URLs stay messy on your site.
Unique visitors, visits, pageviews, views per visit, bounce, duration. Line, bars, or auto.
The numbers sit on the chart. Click a tile to overlay. Compare draws the previous window as a dashed line. Unique visitors reset at midnight UTC. A visit is the same person within 30 minutes. Visit duration is last minus first pageview in that visit. One-page visits are 0 seconds. No heartbeat, no extra script.
Who is on which path right now, without a heartbeat.
People on the site in the last five minutes. The path is their last pageview. A tab left open does not ping. No extra script. The pill at the top of the dashboard jumps to the list.
Around the clock we check that your site still answers. You should know before the client does.
They clicked Reject. The hostname still has to answer. HTTP, TLS, and DNS on a site you already added. Frankfurt every window; Dublin only if Frankfurt failed. Down means both failed. Slow is not down. A public status page and a monthly report. Visitor 404s via cfa('404'), 500s via cfa('500'). Down windows shade the analytics chart. No Watch SKU — it follows the invoice. Recipe: /docs/watch.
A signup is a signup. It is not another pageview on the invoice.
Ask whoever ships the site to call cfa('signup') when the thing happens. There is no tag-manager UI yet. Events are not billed. Marketers without a developer still get pageviews, sources, and landing campaigns from the paste. Hobby and Starter keep a single named goal.
The briefing you already see, mailed once a week. No extra tracking.
Monday, once. Visitors, pageviews, top page and source from the last 7 days. Unsubscribe is a link. Switch it off in account settings. Not a daily drip.
The pattern, the mix, what to open next. Dashboard numbers only — no hashes.
Owner click. Grok writes from the tiles you already see. Copy it into a Monday email. Hobby 6 a day, Starter 12, Growth 20. Cached reads are free. The weekly mail is the same numbers, not a second tracker.
You write a launch. The first day a UTM campaign arrives, we stamp it. Volume stays on the chart.
Vertical line, tooltip, list. Type a note, or we add “Campaign: …” the first time that campaign (or source / medium) is seen. Day-over-day traffic % is not a note — the tiles already show that. The Monday briefing is separate.
Sign in with the Google account that owns Search Console. Empty until then — no invented clicks.
Connect Google on the dashboard. You grant Search Console read on a site you own. We show totals plus top queries and Google landing pages for the same range as the board: clicks, impressions, CTR, and average position. Empty until you connect — we do not invent clicks.
Connect the Stripe account that takes payment. Empty until then — no invented euros.
OAuth, read-only. Gross, refunds, net, and charge count for the board range. If Checkout already stored utm_source / medium / campaign in metadata, we list those tags. Clicking one filters your pageviews. It does not prove that visit paid. Stripe account, not this hostname. Not mixed into visitor rows.
Click a country to zoom. Tabs for regions and cities. No map tiles, no postcode.
A country outline on the dashboard. Click to filter. Regions and cities are labels on the request, not a café database. No IP on the row, no coordinates, no postal code.
Drop-off between pages and events. Midnight starts a new person.
Growth only. Linear path, same UTC day. Midnight resets the person. That is the privacy trade, not a hidden cap. Two to eight steps: a path or a named event. Hobby and Starter keep a single named goal. No extra script. No session replay.
A Frankfurt GET we run. Google lab scores 0–100. The 1 KB script does not guess dwell or LCP.
First byte is four signals from a GET we make in Frankfurt, then what to do. Lighthouse (Performance, Accessibility, Best Practices, SEO) comes from PageSpeed Insights. Lab, not field. Refresh always runs a new audit. Scores are not cached. Not a Core Web Vitals product.
Opt-in. The 1 KB file stays 1 KB. A second helper counts the click.
Tick “also count clicks” in site settings. That adds a second file, cf-clicks.js: outbound hosts, file extensions (pdf, zip, …), buttons, and anything with data-cfa="…". Same beacon, named events, not billed. Not a heatmap. The default script does not listen.
A checkout path and goals from events that already fire. You confirm. Nothing invented.
The dashboard can read your homepage menu and the paths that already have pageviews. On Growth it can save same-day funnels if those URLs exist — not a second copy of one you already added. Goals still need a named event that already fired. Owner click, not a silent rewrite.
Upload the plugin. Paste the public ID. Pageviews without a MonsterInsights cookie.
GitHub zip today; WordPress.org listing is later. WordPress.com cheap plans still paste the snippet. Serving the file from your own hostname so blockers miss us is optional — recipe on /docs. Topic: /wordpress-analytics.
Same numbers as the dashboard. No visitor hashes. Read API and MCP on /docs/api.
Optional. List-based blockers never see our hostname if the file comes from yours. On Hobby.
A path rewrite of /cf.js, or a c. CNAME. CNAME keeps visitor IP, city, and same-day uniques. Path rewrites recover blockers but collect through the host. Shopify and other closed builders: paste the snippet, then CNAME. Recipe: /docs/proxy.
A hashed bearer. The same visitors, pages, sources, and live you already see.
Starter and Growth. Mint a token on Account. We store a hash, show the secret once. Sites, overview, pages, sources, live. Growth adds funnels. No visitor hashes. No raw pageview dump. Hobby stays the dashboard. Recipe: /docs/api.
Ask after a deploy. OAuth 2.1 at https://www.cookiefreeanalytics.com/mcp, or the hashed bearer.
Starter and Growth. Claude and Cursor sign in on this host. curl still uses the token from Account. The model sees aggregates, not hashes. Recipe: /blog/cookieless-analytics-mcp.
Pages, referrers, campaigns, and the rest of the board as a workbook. We do not keep the file.
The Excel button on the dashboard downloads what you are looking at. Account can export and delete. No sales call. No weekly dump we host for you.
The moat is how we collect and how we forget. Full recipe on /methodology.