Product overview

How Optin Model Analytics Works

Add the tracking script to your site, collect privacy-minimized events, and analyze approved data from infrastructure you control.

Step 1

Register your website

Add a name and domain in the dashboard. Optin Model Analytics creates a website token and checks each browser request's Origin or Referer against the registered domain, allowing matching subdomains.

Website domains (opens in a new tab)

Step 2

Install the tracking script

Paste the generated snippet into your site. The script sends a view event when a page loads. Use emit(...), or mark buttons, links and forms with tracking attributes, with fixed, non-identifying event names and an optional goal code from config/goals.yaml to measure important interactions and conversions.

Tracking setup (opens in a new tab)

Step 3

Measure at the right level

Events use anonymous mode with a sanitized path, coarse dimensions, and no visitor or session identifiers unless enhanced analytics is granted. For maximum privacy, the strict collection profile stops all browser storage, device probing, and referrer collection.

Measurement model (opens in a new tab)

Step 4

Connect BI tools or AI

Events are stored in your database. On a server database, connect BI tools or an AI assistant with a read-only account limited to approved views. For SQLite, export approved view results instead of sharing the database file. Completed periods with low volume remain suppressed.

View table and BI view structure

Connect BI and AI tools (opens in a new tab)

What happens when an event arrives?

Privacy Mode

Anonymous mode

  • Sanitizes the page path and keeps a safe event name.
  • Uses coarse referrer, device, and viewport categories.
  • Omits analytics identifiers, cookie values, and exact dimensions.
  • Includes custom properties only when explicitly configured for collection without enhanced consent.
  • Retains a goal only when its enabled definition permits anonymous use.
  • Drops a disallowed goal without dropping the event and returns a generic SDK warning.
  • Stores the event in a server-generated UTC hour bucket.
Consented Detail

Enhanced analytics

  • Your consent manager calls setConsent(true) only after the visitor grants enhanced analytics consent.
  • May include visitor and session IDs, properties, and exact dimensions.
  • Goal codes remain restricted to enabled definitions in config/goals.yaml.
  • Uses a sliding 30-minute session cookie and records an exact server timestamp.
  • Your integration calls setConsent(false) on rejection or withdrawal.
After setConsent(false), Optin Model Analytics clears its browser identifiers and returns to anonymous mode. Privacy-minimized events, configured consent-free properties, and anonymous goals continue unless collection is disabled or the path is excluded. Consent withdrawal does not delete data already stored by the server.

Enhanced analytics consent (opens in a new tab)

Minimal collection

Strict Collection Profile

collection_profile: strict

The strict collection profile reduces collection to what counting a page view or safe interaction requires. The tracker reads and writes no browser storage and reads no device details, and the server discards every other dimension when an event arrives.

What Strict Mode Retains

  • Sanitized page path: The normalized URL path without query parameters or hash fragments.
  • Safe event name: A fixed action name (e.g., view or approved custom events).
  • Approved goal code: Only active goals defined in config/goals.yaml.
  • UTC hour bucket: Server-stamped hourly aggregation window without exact timestamps.
  • Core protection: Ingestion kill switch, sensitive-path exclusions, domain rules, and rate limits remain active.

What Strict Mode Completely Omits

  • Zero browser storage: Never sets, reads, or deletes cookies, localStorage, or sessionStorage.
  • No device or viewport dimensions: Device type, screen resolution, and viewport are recorded as unknown.
  • No referrer URLs: Referrer channel and search terms are omitted and recorded as unknown.
  • No geographic lookups: Server performs no IP-to-location lookups; coarse geography is not derived.
  • No visitor or session identifiers: setConsent() changes nothing; no identifiers are created.
  • No custom properties or page depth: Mapped query params, custom properties, and page depth counters are discarded.

Administrators turn it on under Collection → Collection controls, with collection_profile: strict in the configuration file, or with the COLLECTION_PROFILE environment variable, which takes precedence. The server applies the strict profile to every request, including direct API calls; copies of the tracker hosted elsewhere, such as on a CDN, also need to opt in on the page so they avoid those browser reads.

Strict profile in the privacy guide (opens in a new tab)

Opting in a static or CDN tracker (opens in a new tab)

Regulatory consideration: The strict profile minimizes what the tracker touches on a device, but it does not by itself make measurement exempt from consent. European guidance treats a script that makes the browser send information, including the page address, as within Article 5(3) of the EU ePrivacy Directive, and exemptions for audience measurement differ between countries. Operators remain responsible for their legal basis, notices, and privacy governance.

Controls you manage

  • Registered domains and website tokens
  • Collection profile: switch between Standard (with anonymous/enhanced modes) and Strict (zero-storage minimal collection)
  • A global collection switch and sensitive-path exclusions
  • Enabled goal codes and whether each may be retained anonymously
  • UTM and query parameter mappings, per-property consent, and custom reporting columns
  • Optional local, coarse geography
  • Low-volume disclosure thresholds for approved BI views
  • The JavaScript namespace and ingestion rate limit

All six standard UTM properties require consent by default. For anonymous attribution, we recommend no more detail than utm_medium, using channel codes such as email, social, or cpc. Each property can be allowed separately; more detailed UTMs may reveal campaign information, search text, or identifiers, so review their values before overriding this recommendation.

Administrative controls (opens in a new tab)

Privacy is an ongoing responsibility

Privacy-minimized data is not guaranteed to be legally anonymous. Operators remain responsible for legal basis, notices, consent behavior, retention, access controls, and rights requests.

Keep event and goal names fixed and non-identifying. The goal allowlist cannot detect sensitive meaning: a broad goal can still be sensitive when combined with a path or small audience. Do not send emails, account IDs, form contents, search terms, or other free text as enhanced properties.

Get Started Read the documentation (opens in a new tab)