Tracker Script#

The Antics collection tracker is a dependency-free JavaScript file that runs in the browser. It collects pageviews, custom events, scroll depth, attention evidence, and Core Web Vitals. The tracker sets no cookies and does not access localStorage or sessionStorage.

How It Works#

On page load, sends a POST /api/event with the page URL, referrer, and viewport width
On page navigation (SPA), intercepts pushState/replaceState and sends another event
On page exit (visibilitychange hidden), sends time spent on the page and max scroll depth
Core Web Vitals (LCP, INP, CLS) are measured via PerformanceObserver and sent on page exit

Privacy#

Daily pseudonymous visitor bucket: the server computes a 64-bit xxh3 value from a random midnight-discarded salt, registered site, user agent, and IP address. This groups same-day events; it is not a cryptographic identifier or an anonymity boundary. The public calendar date is not the salt.
No raw IP in analytics events: the source IP is used for GeoIP lookup and visitor-bucket derivation. The raw IP address is not stored in analytics events.
No collection cookies or browser storage: the tracker sets no cookies and does not access localStorage or sessionStorage.
No active device probing: the tracker does not use canvas, font, or WebGL probing. It does collect viewport width, performance entries, and interaction counts described in the tracker reference.

Payload Format#

Each event is a JSON POST to /api/event:

{
  "n": null,           // event name (null = pageview)
  "u": "https://...",  // page URL
  "r": "https://...",  // referrer
  "w": 1920,           // viewport width
  "k": "...",          // optional site-scoped tracker token
  "t": 5,              // seconds on previous page
  "p": {}              // custom event properties
}

Script Attributes#

<script defer src="https://your-antics-instance/antics.js"
        data-api="https://your-antics-instance/api/event">
</script>

data-token: route this install to a registered path or bind it to a revocable site token. Host installs can omit it.
data-api: override the event collection endpoint (default: same origin as the script)

For path-scoped sites, register the full prefix (host/path) and keep data-token in the snippet. Browser referrer policy can strip the path from cross-origin requests, so the token-bound route is the supported install path for GitHub Pages project docs, Sphinx subdirectories, and similar static publishing setups. Tokenless events on the same host continue to report to the host site.

Outbound Link Tracking#

If you want to track clicks on external links, add this after the tracker:

<script>
document.addEventListener('click', function(e) {
  var a = e.target.closest('a');
  if (a && a.hostname !== location.hostname)
    antics.event('Outbound Link', { url: a.href });
});
</script>

Content Blockers and Server Logs#

Some content blockers prevent third-party analytics scripts from loading. Antics supports two alternatives when this affects coverage:

Self-host the script: serve antics.js from your own domain (e.g., /js/a.js) so ad blockers don’t recognize it
Caddy log ingestion: enable ANTICS_LOG_PATH on TurtleTech-managed infrastructure or a compatible gateway to ingest eligible server requests

Server-log events provide request coverage rather than browser interaction signals. Apply the same disclosed privacy and retention policy to the source logs.