Website Analytics

Einblick Analytics measures traffic, acquisition, and engagement without cookies or cross-site tracking. Open Websites to set up analytics, allow domains, and view reports.

Register and manage a website

Websites is the shared inventory for Sites built with Einblick, SDK/editor registrations, and analytics-only websites. Grid and table views show each website's capabilities, status, connected-domain count, public site key, and current preview. Search by name or site key and filter by status.
Select Add website, then enter a name and exact production origin. Einblick creates the public site_... key, allows that origin, enables analytics, and starts with the after_consent collection policy.
Builder Sites and SDK/editor registrations appear in the same hub. Open their Analytics tab to enable reporting. Enabling analytics opts in all connected origins and uses after_consent; a builder-hosted Site remains network-silent because the Einblick Builder does not yet provide a consent manager.
The website overview shows the preview, connected origins, and an installation guide while analytics is not yet connected to an active allowed origin. After collection is connected, the guide disappears from the overview but remains available under Settings -> Analytics. Copy the public site key from the website actions; Settings separates general details, domains, analytics privacy and retention, and—when an SDK/editor registration is attached—its publishable site-key settings.

Data that is stored

An accepted event contains only the data needed for analytics reports:

URL path and, when available, the framework route template;
domain and environment (production, preview, or development);
external referrer domain and explicitly supplied UTM values;
country and coarse browser, operating-system, and device information;
timestamp, visible engagement duration, and configured custom events;
a rotating daily pseudonymous identifier scoped to this website.

Einblick stores no cookies, browser storage, or persistent visitor ID. Page titles, full URLs, fragments, and non-UTM query parameters are not stored. The IP address and full User-Agent are processed transiently at the edge only to derive the daily pseudonymous identifier and coarse device information, then discarded.

Install in Next.js

Install analytics independently from the data SDK and editor:

npm install @einblick/analytics

Set the public website key and mount the App Router adapter once in the root layout:

NEXT_PUBLIC_EINBLICK_SITE_KEY=site_...

import { Analytics } from '@einblick/analytics/next'
 
export default function RootLayout({ children }) {
  return (
    <html>
      <body>
        {children}
        <Analytics />
      </body>
    </html>
  )
}

The Next adapter emits the initial pageview and one pageview after each committed soft navigation. Do not mount the generic History API tracker beside it.

When Website settings use after_consent, do not use the immediate-collection snippet above. The host website owns the consent UI and persistence. Map its current analytics choice to component state:

import type { AnalyticsConsent } from '@einblick/analytics'
import { Analytics } from '@einblick/analytics/next'
 
export function EinblickAnalytics({ consent }: { consent: AnalyticsConsent }) {
  return <Analytics consent={consent} />
}

Use unknown before a decision, granted after acceptance, and denied after rejection or withdrawal. Einblick does not display a consent banner or read a CMP automatically.

Vanilla and React

Use the framework-agnostic runtime when navigation is managed manually:

import { initAnalytics, track } from '@einblick/analytics'
 
const analytics = initAnalytics({ siteKey: 'site_...' })
analytics.pageview()
track('cta_click', { placement: 'hero' })

React applications can mount Analytics from @einblick/analytics/react. Multiple mounts with the same key are deduplicated, including React Strict Mode development mounts.

Custom event names use lowercase letters, numbers, and underscores and must start with a letter. Properties are flat and limited to strings, finite numbers, booleans, or null. Do not put personal data, full URLs, free-form messages, or secrets into event names or properties.

New website configurations default to after_consent. Einblick does not show a consent banner or store the visitor's choice. The host website is responsible for both.

always collects cookieless analytics immediately and should be selected only with a documented legal basis.
after_consent performs no event or presence request until the host passes granted; the collector also rejects clients that do not mark the request as originating from an explicit host decision.
denied stops collection, clears the in-memory queue, and stops heartbeats.
beforeSend can redact or drop sensitive routes before transport.
Website settings can exclude bounded path prefixes such as /account. The collector rejects matching events and active-now signals before identity derivation or storage, including events from automatically mounted builder analytics.

Privacy copy should describe daily pseudonymous measurement rather than claiming complete anonymity or exact person identification.

Global Privacy Control is respected by default as a hard fence and prevents collection even if the host passes granted. Legacy Do Not Track can additionally be enabled by setting respectDoNotTrack; it is off by default because browser support and semantics are inconsistent.

Retention and permanent erasure

Detailed events are retained for 90 days by default. Website settings let you select a period from 1 to 90 days; analytics data is never kept for longer than 90 days. A shorter period permanently removes older events instead of merely hiding them from the dashboard. Reports use those events as well—there is no second analytics history with a longer retention period.

Permanently erase analytics data turns off collection and starts erasing all stored events for the website. The displayed status changes to completed once the data has been fully removed. Analytics cannot be enabled again while erasure is in progress.

The website itself, its domains, and its settings remain available. The record that erasure was requested and completed also remains available for security and audit purposes. Archiving a website only stops collection; it does not erase the existing analytics history.

Privacy notice and controller responsibilities

Cookieless does not mean anonymous, and it does not by itself determine the applicable legal basis or whether consent is required. The website operator decides why analytics is used, configures origins, consent, exclusions and retention, and is normally responsible for informing visitors and selecting an appropriate legal basis. Where Einblick processes the resulting data for that operator, the applicable data-processing agreement and subprocessor terms must cover this service.

A website privacy notice should accurately disclose at least:

the measurement purpose and legal basis chosen by the operator;
transient edge processing of IP address and full User-Agent to derive the rotating daily website-scoped pseudonymous ID and coarse device fields;
the stored data categories described above, including path, external referrer host, UTM values, country and configured custom events;
the configured detailed-event retention of 1–90 days and the permanent erasure process;
Cloudflare as edge, Queue, EU-jurisdiction R2 and Durable Object provider, noting that Queue has no equivalent documented EU jurisdiction guarantee;
Tinybird in AWS eu-central-1 (Frankfurt) as the analytics query store;
the right to object or withdraw consent, depending on the selected legal basis, and how visitors can exercise their data-protection rights.

European hosting choices reduce data-location exposure but do not replace a review of controller/processor roles, the DPA, subprocessors, international transfer safeguards, privacy-notice wording and local ePrivacy or telecommunications rules. Obtain qualified legal review before public launch.

Origins and environments

Collection requires an active website, enabled analytics settings, an active exact origin, and Allow analytics on that origin. Scheme, host, and port must all match. Categorize each origin as production, preview, or development so test traffic can be excluded deliberately.

The public site_... key routes events; it is not authorization. Dashboard reads still require an authenticated Workspace membership and the Analytics permission. Secret API keys and provider credentials never belong in browser variables.

Use analytics reports

Choose the last 7, 30, or 90 days and optionally narrow the report to one connected domain or to production, preview, or development traffic.
The overview compares pageviews, visitors, sessions, bounce rate, and engagement with the preceding period. Select Pageviews or Visitors to change the trend chart; Active now updates from recent visible-page signals.
Page, route, landing-page, exit-page, campaign, and country rows can narrow the entire report. Active filters appear as removable chips. Source, campaign, country, browser, operating-system, and device tabs expose the remaining breakdowns.
Reports refresh while the page is open. Use the refresh button when you need to bypass the short dashboard cache immediately.

Metric definitions

Visitor: one daily website-scoped visitor identifier within a UTC day.
Session: pageviews for that daily visitor separated by less than 30 minutes.
Engaged session: at least 10 seconds of visible engagement or at least two pageviews.
Bounce: a session that was not engaged.
Active now: a visible page signal received within the last 90 seconds; it is an estimate, not proof that a device is online.

Multi-day visitor totals add daily visitors. Network address sharing can merge people, while VPN, network, or browser changes can split one person.

Security headers and troubleshooting

Allow the configured collector origin in connect-src when the host uses Content Security Policy. Analytics sends JSON as text/plain;charset=UTF-8, batches at most 20 events and 32 KB, keeps failed data only in bounded memory, and always fails open without affecting the host page.

When no data appears:

Confirm the public site key and exact origin in Website settings.
Confirm analytics and the origin are enabled for the current environment.
Check that consent is granted when after_consent is selected.
Check whether the current path matches a configured exclusion prefix.
Check CSP connect-src, browser privacy tools, and the debug console in a non-production build.
Remember that configuration changes can take up to the documented cache propagation window.

EINBLICK_API_KEY is a secret server-side data credential. NEXT_PUBLIC_EINBLICK_SITE_KEY is a public routing key. Tinybird, archive, append, and control-plane credentials are server-only infrastructure secrets and must never be copied into a host application.