Tracking script

A lightweight, privacy-focused tracking script.

Basic usage

<script
  defer
  data-site-id="YOUR_SITE_ID"
  src="https://glyphex.io/tracker.js"
></script>

What it tracks

The tracking script automatically collects:

• Page views - Every page your visitors view
• Referrer - Where visitors came from (Google, social media, etc.)
• UTM parameters - Campaign tracking (utm_source, utm_medium, etc.)
• Device type - Desktop, mobile, or tablet
• Browser - Chrome, Firefox, Safari, etc.
• Operating system - Windows, macOS, iOS, Android, etc.
• Country and city - Approximate location from IP (IP not stored)
• Outbound link clicks - Links to external websites
• File downloads - Downloads of PDFs, ZIPs, and other files
• Scroll depth - How far visitors scroll on each page
• Time on page - Duration spent on each page

What it does NOT track

• Personal information (names, emails, etc.)
• IP addresses (used only for geo lookup, then discarded)
• Cookies or persistent identifiers
• Cross-site tracking
• Fingerprinting that could identify individuals

Configuration options

// Opt out of tracking
localStorage.setItem('glyphex_ignore', 'true');

// Opt back in
localStorage.removeItem('glyphex_ignore');

{process.env.NODE_ENV === 'production' && (
  <Script
    defer
    data-site-id="YOUR_SITE_ID"
    src="https://glyphex.io/tracker.js"
  />
)}

Automatic tracking

How visitor identification works

Glyphex uses a privacy-safe approach to identify unique visitors without cookies:

1. A daily-rotating salt is combined with the visitor's IP address and user agent
2. This is hashed to create a temporary identifier
3. The identifier changes each day, preventing long-term tracking
4. The original IP is never stored

This allows accurate unique visitor counts while maintaining privacy.

Modules and script size

The tracker is a small core (pageviews, SPA navigation, custom events, engagement, opt-out) plus optional modules. The per-site tag /t/YOUR_SITE_ID.js ships the core and only the modules you enable in Settings, Tracking code, Features. A missing setting means the module that was always on stays on, so existing sites do not change.

• Outbound links, file downloads: on by default, switch off in Settings
• Rage clicks, Core Web Vitals, JavaScript errors: opt-in
• Heatmaps: opt-in (Starter plan or higher). Records click position (share of page width, height rounded to 10 px), the device class and an element selector (tag, id or first two classes), batched and sent once when the page is hidden. No text, no input values, no recordings
• Broken URLs (404): built into the core, no extra size
• The script tag with /tracker.js loads the full build with every module

beforeSend hook

Inspect, change, or drop any hit before it is sent. Set data-before-send on the script tag to the name of a global function, or beforeSend in window.__glyphex. Return a falsy value to drop the hit, or an object to replace the payload.

<script defer data-site-id="YOUR_SITE_ID" data-before-send="myFilter" src="https://glyphex.io/tracker.js"></script>

window.myFilter = (type, payload) => {
  if (payload.pathname.startsWith("/admin")) return false; // drop
  return payload; // or return a changed copy
};

Tracker options

Set these as data attributes on the script tag, or as the same keys (camelCase) in window.__glyphex. For the per-site tag they are also in Settings, Tracking code, Features.

• data-exclude-search="true": Strips the query string from recorded referrers and 404 URLs. UTM parameters are still read from the URL first.
• data-exclude-hash="true": Hash fragments are never recorded and hash changes never count as pageviews. This is already the default behavior; the option makes it explicit.
• data-auto-track="false": No automatic pageviews, SPA tracking or 404 hits. Call analytics.pageview() and analytics.track() yourself.
• data-tag="variant-b": Attaches a label (max 50 characters) to every pageview and event, for A/B tests or to split environments. Filter by it on the dashboard.
• data-domains="example.com,www.example.com": Only sends data when the page hostname is in this comma-separated list (exact match, so staging and localhost are ignored). Without it the tracker sends from every host.

Manual pageview: window.analytics.pageview("/virtual/path")

<script defer data-site-id="YOUR_SITE_ID" data-auto-track="false" data-tag="variant-b" src="https://glyphex.io/tracker.js"></script>

Declarative events

Add data-glyphex-event to any element to track a click without writing JavaScript. Extra data-glyphex-event-* attributes become event properties.

<button data-glyphex-event="Signup" data-glyphex-event-plan="pro">Sign up</button>

Performance

• Script size: core about 1.9 KB gzipped (under 2 KB). A new site's default per-site script is about 2.2 KB, the full /tracker.js about 3.5 KB.
• Loads asynchronously with defer
• Minimal impact on page load speed or Core Web Vitals
• Uses sendBeacon for exits and clicks, and fetch with an in-memory retry for the rest