Settings, every option

Settings are per site. Everything that belongs to the person or the instance rather than to one site (the list of sites, API keys, people, your password) is in the account dialog, under your picture. Every setting is free; there is no plan that unlocks anything.

The sections are grouped: This site (General, Install, Modules, Sharing), Money (Payments), Data (Search Console, Data & privacy, Alerts) and Instance (Health). A viewer sees every section as it is and changes nothing.

General

The top line shows the site's icon, its domain, timezone and currency, and its state: Receiving visits, No visits in the last day, Stopped or Not installed yet.

Basics

For developers

Look

How the site shows up inside trckable: the site picker, All sites and the header. Visitors never see it.

Reports

Delete this site

Owners only, in two steps. The first lists what goes with the site, in real counts: events, visits, payments, payment connections, share links and widgets, plus its settings, modules, verification and look. You type the domain to continue. The second step is a button you hold down.

There is no undo. Backups made before the deletion still hold the site until they age out. Payment providers keep the webhooks they were given; remove those at the provider.

Install

Until the first visit arrives, this tab is the install card: your site's own snippet, with tiles for a script tag, Next.js and React, and Other ways to install for the rest (Vue, Svelte, Astro, WordPress, Shopify, a proxy on your own domain, a server and many more).

Verify

Once visits arrive, the tab is called Verify, and it checks the install from the outside. The server loads https://<your domain>/ and looks for this site's id in the page. When the id is not in the page, it reads up to 20 of the scripts the page links to (the site's own first, where a bundle lives) and stops at the first one that carries it. Then it asks for the latest visit it recorded.

The result is three lines:

Only the snippet line can verify the install. Verify again runs the check on demand, and Show the code again opens the install card below it. The check reads public pages only, with plain GET requests, and it cannot be pointed at the server's own machine or its private network.

The server also runs the same check for every site once a day, the first time five minutes after it starts.

Stopped

A site is Stopped when no visit has arrived in the last day, and the most recent check, made after that last visit, did not find the site's id. The site picker and the General tab say so, and the site's dashboard shows a notice with the reason from that check: the domain did not answer, another site's snippet is on the page, or the snippet is not on the homepage.

Stopping deletes nothing. Everything recorded before is kept, and the chart shows the gap.

Modules

A module that is off costs nothing: no bytes in the browser, no work on the server, no chunk in the dashboard. The header shows what this site's visitors actually download.

Turning a recording module off leaves a permanent gap — the days in between will have no data, and the confirmation says so. Turning a reading module off only hides a view, and can be undone freely.

Cookie consent is one module with two ways of asking, chosen in Data & privacy. The browser downloads only the one you picked.

Payments belongs to the Revenue module, and the Search Console section to the Search Console module. While its module is off, the section says so and offers to turn it on.

:::note Modules are chosen by the server for script-tag installs and reach visitors within the hour. An app that bundles the tracker through npm picks the change up on its next deploy. :::

Sharing

Two ways to show this site's numbers to people without an account: a link to the dashboard, and a small widget for your own pages.

Share links

A read-only link to this one site's dashboard. Only owners see and make them.

The link is shown once: trckable keeps only a hash of it, as with an API key. The list shows how often each link was opened and when it ends. Revoke stops it at once, including for anyone who has it open.

Embedding a dashboard

A share link can be shown inside another site's page: a public numbers page, a client portal, your own admin. When you make the link, list the sites under Allow embedding on (like https://example.com), then paste the iframe the next step shows:

<iframe src="https://stats.example.com/s/…?embed=1" title="example.com analytics" loading="lazy"
  style="width: 100%; height: 1300px; border: 0;"></iframe>

• Only the sites you listed can frame it: every other page of trckable, and every link without that list, refuses to be framed at all.
• The embed shows the site's name and a small credit instead of the usual header, and it is read-only like any share link. A password still asks once.
• Browsers do not send cookies into an iframe on someone else's site, so an embed keeps its session in the page's memory instead. Nothing is stored in the visitor's browser.
• Revoking the link empties every page it is embedded on.

Widgets

A small card with live numbers, for your own pages. Pick a design, see it with the site's real numbers, and copy one line of HTML. Only the numbers the design shows are public.

A new Live now card starts with the bars and the countries; a new Open revenue card starts with its channels.

The snippet is an iframe sized for the design. A floating widget is the same iframe inside a div with a fixed position, 16 px from the corner; it still runs no script. The copy button in Your widgets gives the inline version.

The widget's page, /w/{id}, is HTML and CSS only:

• It runs no script and sets no cookie. Its content security policy allows styles and nothing else.
• It refreshes itself every 60 seconds. The numbers are read at most once a minute per site, however many pages show it.
• Showing it is never counted as a visit.
• "Counted by trckable" is always under the card, so a visitor can find out what counted them.

Open revenue is shown only while the Revenue module is on; with it off, the page answers not found. The Privacy seal lines come from the site's own settings at the moment the page is drawn: no IP addresses stored, the cookie (none in cookieless mode, one after consent, or one first-party cookie never used for ads), the location recorded (country, or country and city), Do Not Track when it is honoured, how long visits are kept, and that the data is never sold or used for advertising.

A site can have ten widgets. Each one can be switched off or deleted. A widget that is off or deleted, or belongs to a suspended account, answers with an empty page (404), so the pages that embed it show an empty space. Browsers keep the last page for up to a minute, so it disappears from those pages within about a minute.

Payments

When the saved keys cannot be read

Provider keys and signing secrets are encrypted with the instance key (TRCKABLE_SECRET, or data/secret.key). If the server starts with a different key, this tab says the saved provider keys cannot be read. The fix is to start the server with the original key again.

If that key is gone for good, Start over with this server's key is the way out. It is offered to owners of the instance's own account, and asks for your password. It:

• forgets the provider keys and signing secrets saved with the old key, and the Search Console key;
• keeps every payment already recorded;
• makes the current key the one the data is checked against.

Afterwards, reconnect each provider. Looking someone up by email in a data request will not find payments recorded before the start over.

Data & privacy

The tab opens with a strip of five facts about what this site records, as it is set right now: no IP addresses stored; the cookie (cookieless, a cookie after consent, or a first-party cookie); the location (country only, or country, region and city); how long visits are kept; and whether Do Not Track is honoured.

Cookieless mode

One card, one switch. With it on, the script stores nothing in the browser, and visitors are counted by a daily salted hash; the IP is never stored. The card lists what you get (no cookie and no localStorage, country only, Do Not Track and GPC honoured) and what you give up: new versus returning beyond one day, revenue credited across days, and one visitor across midnight UTC counts as two, because the hash is made afresh each UTC day. The card shows when that midnight falls in the site's timezone.

Visitors get the smaller, storage-free script within the hour.

What is recorded

Share links, the week's first day and sections used to be here. Share links are now in Sharing; the week and sections are in General → Reports.

Cookie consent

One card, one decision — keep the cookie and ask first — and one choice inside it: Read my banner or trckable's bar.

With trckable's bar chosen:

With Read my banner chosen:

Your privacy policy

Alerts

Where they go

One destination per site, for all of its alerts; changing it moves the alerts already set up. It can be:

• a Slack, Discord or Mattermost webhook, an n8n webhook, or any other URL that takes JSON;
• an email address, once the server has an SMTP server (TRCKABLE_SMTP_URL and TRCKABLE_MAIL_FROM, see Configuration).

A webhook receives JSON with kind, site, domain, title, message, at and data, plus the same line in text (which Slack and Mattermost show) and in content (which Discord needs). Addresses inside your own network are refused, and so is any redirect that leads to one, so an alert can never probe it.

Send a test sends a test message to the destination and says whether it was delivered, or why not.

What to be told about

The weekly report covers the week that just ended: visitors against the week before, pageviews, bounce rate and time per visit, the top three sources and entry pages, the top goal, and revenue with its change. With TRCKABLE_BASE_URL set, it ends with a link to the dashboard. It is plain text, so it reads the same in a chat tool and an inbox. If the server was down that morning, the report goes out when it is back, for the same week.

Alerts are checked every ten minutes. After an alert is sent, the same one stays quiet for six hours; payments in that time arrive together in the next message.

Health

Not settings, but the page that answers "is it working". It is about the whole instance, so it is shown to everyone who signs in. It refreshes itself every 15 seconds.

• The top line: everything running, or what needs a look, with the version and how long the server has been up.
• Events since boot: accepted, bots and rejected.
• Writer: how many events are safe in the log but not yet in reports.
• Memory: the whole process's resident memory, analytics store included, where the server can read it (on Linux). Elsewhere it is the Go runtime's own memory only, and the tile says so.
• Stored: trckable's data on disk, the number of events, and the bytes per event.
• Space for new data: free space on the volume, what is added per day, and how long the space lasts. The rate is the last seven days of stored events.
• Backups: when the last one was written and its size, or when the last one failed and why. The off-site copy: the bucket, how long copies are kept, when the last one arrived, or why the last one failed.
• Payments, once a provider is connected: how many are connected, the last webhook and how many are waiting, and the last reconciliation.

When the disk is full, new visits are turned away until there is room again, and the Space card shows the error. The server tries again every 30 seconds by itself; nothing already stored is harmed.

The same numbers are available to your own monitoring at GET /_trckable/health, with TRCKABLE_OPERATOR_TOKEN — see Configuration.

Your account

The account dialog opens from your picture. Its tabs are Sites, API keys and People (owners only), and Account.

People

Owners run the instance: sites, payments, people and keys. Viewers read every report and change nothing, except their own account; the server enforces it. Only owners see this tab.

The list shows each person's role, whether they sign in with two-step or a password alone, and when they were last seen. People who have not signed in yet, or have not chosen their own password, are listed under Waiting to sign in.

• Add someone: their email and a role. trckable makes a one-time password for you to pass on; it sends no email. The person must choose their own password before anything else works. The server refuses every other request until they do.
• New sign-in details or Reset password: signs the person out everywhere and gives you a new one-time password for them. It asks for your own password first. It never works on another owner: make them a viewer first, which everyone on the instance can see.
• Turn off two-step: for someone who lost their phone and their recovery codes. They sign in with their password alone, then set two-step up again. It asks for your own password, and does not work on another owner either.
• Make an owner, Make a viewer and Remove. The last owner cannot be removed or made a viewer, because an instance with no owner would be a locked door.

After choosing their own password, a person without two-step is offered to set it up. Someone who already has it (an owner's reset leaves it on) is not asked again.

If no owner can get in, whoever runs the server can:

trckabled admin reset-password <email>   # prints a new password; every session is signed out
trckabled admin disable-2fa <email>      # lost phone, no recovery codes

reset-password never takes the password as an argument: pipe one in on standard input, or it makes one and prints it.