@indiebob/tracker 0.3.0 → 0.4.1

package/CHANGELOG.md

@@ -6,6 +6,38 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [0.4.1] — 2026-11-02
+
+- Shorter README. No code changes.
+
+## [0.4.0] — 2026-11-02
+
+Privacy mode is the default: the tracker stores nothing in the visitor's browser, and IndieBob's
+server identifies a visitor for one day from a hash of a daily salt, the project, the IP address and
+the user agent. The 0.3 behaviour is `persistence: 'local'` (needs consent in the EU).
+
+Needs IndieBob's `/api/collect` from 2026-11-02 or later; an older server rejects events without
+`anonymousId`.
+
+### Changed
+- Without `persistence: 'local'`, a visitor who comes back on another day is a new visitor, and a
+  signup is not credited to a visit on an earlier day.
+- In privacy mode `identify()` sends `signup` / `login` only when you pass `{ isNew }`.
+- `getAnonymousId()` and `getSessionId()` return `''` in privacy mode.
+- Page paths and URLs keep only the `utm_*` and `ref` query parameters; referrers keep origin and
+  path. A navigation that changes only another query parameter is no longer a new page.
+
+### Added
+- `persistence: 'none' | 'local'`, `data-persistence="local"`, and `bob.setPersistence()` for consent
+  banners (`'none'` removes everything the tracker stored).
+- A warning for unknown or misspelled options.
+
+### Fixed
+- Nothing is written to storage before Do Not Track, Global Privacy Control and opt-out are checked.
+
+### Size
+- Script tag 5,699 bytes gzipped (0.3.0: 5,076).
+
 ## [0.3.0] — 2026-11-01
 
 The npm module bundles (`index.js`/`.cjs`, `vue.js`/`.cjs`) are no longer