Tracking snippet
One script tag, loaded with defer so it never blocks rendering.
<script defer data-site="YOUR_SITE_ID" src="https://api.shonylabs.com/js/YOUR_SITE_ID.js"></script>What's captured on every pageview
- URL, path, and referrer
- UTM parameters (source/medium/campaign/term/content), plus lightweight non-UTM params:
ref,source,via - Language and timezone (
Intl.DateTimeFormat) - Screen and viewport dimensions
- Browser, OS, and device type, plus country/region/city — parsed server-side from the request
Visitor and session IDs
A visitor_id is generated once and stored in localStorage, so it persists across visits on the same browser. It's also mirrored into a first-party shonylabs_visitor_idcookie so your own backend can read it server-side — that's how the transactions API links a purchase back to a visitor.
A session_id uses a sliding 30-minute inactivity window, stored in sessionStorage: any activity resets the timer, and a new session starts once 30 minutes pass with no activity.
Need to avoid a cookie consent banner instead? Swap this snippet for the script-cookieless.js variant, which never touches cookies or browser storage — see GDPR & cookieless tracking for the trade-offs.
Single-page apps
The snippet patches history.pushState and listens for popstate, so a route change without a full page reload still fires a new pageview (debounced by 100ms so a rapid sequence of history changes only fires once).
Outbound link clicks
Clicking a link to a different hostname automatically fires an outbound_link_click event with the destination URL — useful for seeing where visitors go when they leave your site.
Delivery
Events are sent with navigator.sendBeacon when available (survives the page unloading), falling back to a fetch call with keepalive: true. Every send is fire-and-forget — a failed or slow request never blocks the page.