Script tag and options

Pinned, with Subresource Integrity

Use the versioned URL with its integrity hash; both come from GET https://collect.plaintrace.dev/v1/sdk and the dashboard shows them under Settings → Install.

<script>if(!window.px){var p=window.px=function(){p.q.push(arguments)};p.q=[];p.s=1}</script>
<script async src="https://collect.plaintrace.dev/v/0.2.1/t.js"
        integrity="sha384-…" crossorigin="anonymous"
        data-site="<site id>"></script>

A published version never changes, so the hash keeps matching. https://collect.plaintrace.dev/t.js always serves the latest release (cached for five minutes) if you prefer automatic updates.

The one-line stub lets you call px(...) before the script arrives; the calls are applied in order once it does.

Options

data-* attribute	init() field	Default	Effect
data-site	site	required	The site id (public).
data-endpoint	endpoint	the script’s origin	The collector, or your first-party proxy path (e.g. /_i).
data-require-consent	requireConsent	false	Nothing is measured until consent('granted').
data-respect-gpc	respectGpc	false	Browsers sending Global Privacy Control are left out.
data-respect-dnt	respectDnt	false	Browsers sending Do Not Track are left out.
data-storage="none"	storage: 'none'	auto	Even the consent answer and the opt-out stay in memory.
data-exclude-paths	excludePaths	none	Comma-separated; exact or with a trailing *. Nothing is sent there.
data-debug	debug	false	Logs deliveries; lets automated browsers send events.
	pageUrl	none	Rewrites each address before it is recorded. See clean URLs.

Delivery

Events are batched and sent with fetch (or a beacon when the page closes). Failed sends are retried with backoff and the collector’s Retry-After; what is finally lost is counted and reported, so reports can say how complete they are. Automated browsers (Playwright, Puppeteer, Selenium) are not counted unless debug is on.