tacilytics 2.2.0 → 2.4.0

package/README.md

@@ -5,7 +5,7 @@
 # Tacilytics
 
 **Privacy-first, cookieless analytics for websites and apps — self-hosted in minutes.**
-*Tacit* (adj.): understood without being said. Tacilytics counts what matters and keeps quiet about who did it — one tiny script, one Node process, one SQLite file. No cookies, no consent banner, no creepy tracking. (And in Italian, *taci* simply means "be quiet".)
+*Tacit* (adj.): understood without being said. Tacilytics counts what matters and keeps quiet about who did it — one tiny script, one Node process, one SQLite file. No cookies, no IDs, no creepy tracking. (And in Italian, *taci* simply means "be quiet".)
 
 > Formerly **Nyx Analytics**. Existing installs keep working: `/nyx.js`, `window.nyx()` and the old Flutter class names are still supported as aliases.
 
@@ -22,7 +22,7 @@
 
 ## Why Tacilytics
 
-- 🍪 **Cookieless & banner-free.** No cookies, no `localStorage`, no fingerprinting — nothing to consent to.
+- 🍪 **Cookieless.** No cookies, no IDs, nothing written to the visitor's device, no fingerprinting. **Strict mode** (`data-strict`) also reduces what the tracker reads on the device to what every page request carries anyway — see [Strict mode](#strict-mode).
 - 🛡️ **IPs are never stored.** Unique visitors are counted with a *daily, salted, one-way hash* that’s irreversible and rotated every day.
 - 🌍 **Region from the browser timezone**, never from IP geolocation.
 - 🔍 **Segment everything.** Click any country, page, source, browser or campaign to filter the whole dashboard — stacked, with one-click chips.
@@ -72,7 +72,7 @@ Open the dashboard, log in, click **+ Add site**, and drop the snippet into your
 <script defer data-domain="example.com" src="https://analytics.example.com/tacilytics.js"></script>
 ```
 
-That’s it. Pageviews start flowing in — no cookie banner required.
+That’s it. Pageviews start flowing in, without cookies. (Want the tracker to read less on the device as well? Add `data-strict`, see [Strict mode](#strict-mode).)
 
 ## Custom events, goals & properties
 
@@ -110,11 +110,59 @@ Opt-in flags on the `<script>` tag:
 ```html
 <script defer data-domain="example.com"
         data-honor-dnt          <!-- skip tracking if DNT / Global Privacy Control is on -->
+        data-strict             <!-- reduce device reads (see Strict mode) -->
         data-track-outbound     <!-- auto-record clicks to other domains as events -->
         data-track-downloads    <!-- auto-record file downloads (pdf, zip, docx …) as "File Download"; or ="pdf,epub" -->
         src="https://analytics.example.com/tacilytics.js"></script>
 ```
 
+### Strict mode
+
+The default tracker writes nothing to the visitor's device, but it does **read** a few things there: one `localStorage` flag (your own visits, below), the time zone (→ country), the browser language, the window size (→ scroll depth) and, with `data-honor-dnt`, the DNT/GPC setting. EU device-access rules (ePrivacy Art. 5(3), in Germany § 25 TDDDG) cover reading as well as storing, and the EDPB reads "access" broadly (Guidelines 2/2023 also count information a script makes the browser send). Strict mode reduces device access to what every page request carries anyway:
+
+```html
+<script defer data-domain="example.com" data-strict data-honor-dnt src="https://analytics.example.com/tacilytics.js"></script>
+```
+
+In strict mode the tracker does not read local storage, the time zone, the language, the window or screen size, or the DNT/GPC setting. It sends what the page knows: domain, path, referrer, UTM parameters and time on page; the browser adds its usual request headers. To get there it still uses page state, not device properties: `location` and the query string (UTM), `document.referrer`, the DOM for the optional 404 and site-search detection, and a check that `navigator.sendBeacon` exists. Some authorities (EDPB Guidelines 2/2023) read the rules more broadly than "device properties", so do not take "strict" as "nothing at all". The server takes the language from `Accept-Language`, and with `data-honor-dnt` it checks the `DNT` / `Sec-GPC` request headers. Two things are still used for timing and never sent: the page's visibility state (`document.visibilityState`) and the device clock (`Date.now()`, only differences, for time on page). A test runs the tracker with every other device API booby-trapped and fails if strict mode touches one.
+
+**WordPress plugin:** its role exclusion (don't count logged-in admins, editors …) uses a `localStorage` marker in a small inline script before the tracker. Turn the role exclusion off when you use strict mode; a later plugin release will handle it on the server.
+
+What you give up: **no country** (it came from the time zone), **no scroll depth** (time on page stays), and `?tacilytics=off` does not work (the console says so) — exclude your own visits another way (e.g. a test browser you don't count, or filter yourself out in the dashboard). Strict mode does not decide whether you need consent; that depends on your jurisdiction and the rest of your website. This is not legal advice.
+
+### Server mode (no script at all)
+
+Server mode runs no script and reads or stores nothing on the visitor's device. Your web server reports each page view itself, from the request the visitor sent to your page anyway: path, `Referer`, `Accept-Language`, `User-Agent` and the visitor IP. Don't add the `<script>` tag on pages that use server mode; mixing both on one page would bring the script back.
+
+```http
+POST /api/v1/hit
+Authorization: Bearer tk_…            # a key created with write access (Settings → API keys), not read-only
+Content-Type: application/json
+
+{ "domain": "example.com", "path": "/shop?utm_source=news", "ip": "203.0.113.7",
+  "ua": "<User-Agent header>", "referrer": "<Referer header>", "lang": "<Accept-Language header>",
+  "purpose": "<Sec-Purpose or Purpose header>" }
+```
+
+Node / Express, after your static files and before your pages:
+
+```js
+app.use((req, res, next) => {
+  if (req.method === 'GET' && req.accepts('html')) fetch('https://analytics.example.com/api/v1/hit', {
+    method: 'POST', headers: { Authorization: 'Bearer ' + process.env.TACILYTICS_KEY, 'Content-Type': 'application/json' },
+    body: JSON.stringify({ domain: 'example.com', path: req.originalUrl, ip: req.ip, ua: req.get('user-agent'),
+      referrer: req.get('referer'), lang: req.get('accept-language'), purpose: req.get('sec-purpose') || req.get('purpose') }),
+  }).catch(() => {});
+  next();
+});
+```
+
+- **The visitor IP** is only accepted here, with a write key, never on the public `/api/collect`. It is hashed like a tracker hit (daily salt) and never stored. Behind a proxy or load balancer, send the real visitor IP (e.g. `req.ip` with Express `trust proxy` set right), not your proxy's. Without an IP the hit is refused (`400`), because all visitors would fall onto one hash.
+- **Filtered on our side:** bots and monitors (same list as the tracker), requests without a user agent, prefetch / prerender (`purpose`), and `dnt: true` / `gpc: true` if you choose to forward those headers. A site-limited key can only report for its own sites.
+- **Page caches and CDNs:** if a cache plugin or a CDN (e.g. Cloudflare) answers the request, your server code never runs and the visit is not reported. Report from somewhere every request passes, or exclude HTML from the cache.
+- **What you give up compared with the script:** no time on page, no scroll depth, no click / outbound / download events, no country, and no `?tacilytics=off`. Server-side goals work: add `"name": "Purchase", "props": { "value": 49.9 }`.
+- **Data protection:** the IP and user agent are personal data while they are hashed. That needs a legal basis (typically legitimate interest, GDPR Art. 6(1)(f)) and a sentence in your privacy policy. If someone else runs Tacilytics for you (for example Tacilytics Cloud), your server passes visitor IPs to them, so you need a data processing agreement (DPA). Server mode does not decide whether you need consent for the rest of your website. This is not legal advice.
+
 **Your own visits:** open your site once with `?tacilytics=off` (e.g. `https://example.com/?tacilytics=off`) and that browser is no longer counted on that site. `?tacilytics=on` undoes it. It is stored in the browser's localStorage, nothing is sent; repeat it on every browser and phone you use. Settings → Security has the links for all your sites.
 
 ## Mobile & desktop apps
@@ -225,6 +273,7 @@ curl -H "Authorization: Bearer $TACILYTICS_API_KEY" \
 | `POST /api/v1/sites` | add a site `{ domain }` |
 | `GET /api/v1/stats?site=&period=` | aggregated stats — `today \| 7d \| 30d \| 90d \| 12mo`, or `from=YYYY-MM-DD&to=YYYY-MM-DD` |
 | `GET /api/v1/realtime?site=` | online count, 30-min pulse + recent events |
+| `POST /api/v1/hit` | server mode: report a page view from your web server (write key), see [Server mode](#server-mode-no-script-at-all) |
 
 Add any of `country, source, page, browser, os, device, lang, medium, campaign, goal` to `/stats` to segment, e.g. `…/stats?site=example.com&period=30d&country=DE&medium=email`.
 
@@ -256,8 +305,9 @@ row per pageview. The dashboard aggregates it with plain SQL.
 
 **The cookieless trade-off, honestly:** because there’s no persistent identifier, Tacilytics
 counts unique visitors *per day* and can’t follow the same person across days or
-devices. You get the 95 % that matters (how many, which pages, from where) with 0 %
-cookie banner — the same approach as Plausible/Fathom.
+devices. You get the 95 % that matters (how many, which pages, from where) without cookies,
+the same approach as Plausible/Fathom. Whether you still need consent depends on your
+jurisdiction and setup; strict mode (`data-strict`) reduces the device reads further.
 
 ## Light mode & German
 
@@ -273,9 +323,11 @@ Out of the box the dashboard opens with one shared passphrase (`WEB_PASSWORD`).
 | Role | Can |
 |---|---|
 | **Owner** | everything, including the team |
-| **Admin** | add/remove sites, share links, funnels |
+| **Admin** | add/remove sites, share links, funnels — optionally limited to **specific sites** |
 | **Viewer** | read only — optionally limited to **specific sites** |
 
+**Hosting several customers on one instance** (2.3): give each customer an **admin limited to their sites**. The operator adds their sites; a domain that already belongs to someone else is refused (409) instead of being shared. Pause a site with `PATCH /api/sites/:id {"paused": true}` (server key or an unlimited owner/admin): it collects nothing until resumed, the data stays. `GET /api/v1/usage?month=YYYY-MM` lists page views per site for volume checks (operator only). The operator's `DIGEST_WEBHOOK_URL` is never used for alerts of limited accounts; set `DIGEST_WEBHOOK_URL=off` on a shared instance so the daily digest does not list customer domains. `DASHBOARD_EXTRA_SCRIPT=/path.js` adds one same-origin script to the dashboard (e.g. a billing banner served by your own proxy). Paused sites are left out of alerts and the weekly report. Site-limited accounts cannot add or delete sites (the operator does both, sites are what is billed and paused). **Domains are first come, first served:** if a customer gets 409 for a domain they own, the operator resolves it with an owner account (move the site to the right account in Settings → Team); domain verification is planned.
+
 Everyone can turn on, **optionally**:
 
 - **Passkeys** (Face ID, Touch ID, Windows Hello, security keys). A passkey replaces password *and* code and cannot be phished.
@@ -303,6 +355,7 @@ The server-wide `API_KEY` from `.env` keeps owner rights for agents and the CLI
 | `API_KEY` | — | Bearer key for the API / CLI |
 | `DB_PATH` | `./data/analytics.db` | SQLite path |
 | `DIGEST_WEBHOOK_URL` | — | Daily digest + default alert target (Discord/Slack-compatible). `off` disables it |
+| `DASHBOARD_EXTRA_SCRIPT` | — | One same-origin script added to the dashboard page (hosting banner). Only a plain path like `/cloud/ui.js`; URLs, `//` and `..` are ignored |
 | `WATCH_MIN_VISITORS` | `10` | Spike/drop alerts stay silent below this many visitors per hour |
 | `SMTP_URL` / `REPORT_FROM` | — | Mail server + sender for the weekly report |
 | `REPORT_HOUR_UTC` | `6` | Monday hour (UTC) the weekly report goes out; it covers the last 7 full days in each site's time zone |
@@ -317,6 +370,8 @@ The server-wide `API_KEY` from `.env` keeps owner rights for agents and the CLI
   - **One process only.** The salt is drawn by the single Node process. Running several processes against the same `data/` would let each draw its own salt at midnight.
 - **Data minimisation:** set `DATA_RETENTION_DAYS` to auto-purge raw events after your chosen window.
 - **Respects DNT / Global Privacy Control** when you add `data-honor-dnt` to the tag.
+- **Strict mode** (`data-strict`) skips the device reads (no localStorage, time zone, language or window size). See [Strict mode](#strict-mode).
+- **Server mode** (`POST /api/v1/hit`) runs no script on the visitor's device at all; your server reports the page view. See [Server mode](#server-mode-no-script-at-all).
 - Engagement time adds **no new identifier** — it’s matched to the visitor’s own daily hash server-side.
 - Custom event properties are capped (scalars only, size-limited) so they can’t become a PII dumping ground.
 - Passwords hashed with scrypt; session tokens, invite links and recovery codes are stored only as SHA-256. Sessions live in the database (survive restarts, expire after 30 days).
@@ -329,7 +384,9 @@ The server-wide `API_KEY` from `.env` keeps owner rights for agents and the CLI
 
 | | Tacilytics | Google Analytics |
 |---|---|---|
-| Cookies / consent banner | ❌ none | ✅ required |
+| Cookies | ❌ none | ✅ yes |
+| Reads from the device | a few (time zone, language, window size, one localStorage flag); none in strict mode | ✅ a lot |
+| Works without any script on the visitor's device | ✅ server mode | ❌ |
 | Stores IPs / personal data | ❌ never | ✅ yes |
 | Self-hosted, you own the data | ✅ | ❌ |
 | Weight | ~2 KB | ~45 KB+ |

package/auth.js

@@ -660,7 +660,7 @@ function setupAuth({ app, db, WEB_PASSWORD, API_KEY, rateLimited, clientIp, site
     const b = req.body || {};
     const role = cleanRole(b.role);
     if (!role) return res.status(400).json({ error: 'Role must be owner, admin or viewer' });
-    const sites = role === 'viewer' ? cleanSites(b.sites) : null;
+    const sites = role !== 'owner' ? cleanSites(b.sites) : null; // admins and viewers can be limited to sites
     if (sites === undefined) return res.status(400).json({ error: 'sites must be a list of site ids or null' });
     if (Array.isArray(sites) && !sites.length) return res.status(400).json({ error: 'Pick at least one site' });
     const token = randToken();
@@ -682,7 +682,7 @@ function setupAuth({ app, db, WEB_PASSWORD, API_KEY, rateLimited, clientIp, site
     const role = b.role === undefined ? u.role : cleanRole(b.role);
     if (!role) return res.status(400).json({ error: 'Role must be owner, admin or viewer' });
     if (u.role === 'owner' && role !== 'owner' && q.ownerCount.get().n <= 1) return res.status(400).json({ error: 'There must be at least one owner' });
-    let sites = role === 'viewer' ? (b.sites === undefined ? (u.sites ? JSON.parse(u.sites) : null) : cleanSites(b.sites)) : null;
+    let sites = role !== 'owner' ? (b.sites === undefined ? (u.sites ? JSON.parse(u.sites) : null) : cleanSites(b.sites)) : null;
     if (sites === undefined) return res.status(400).json({ error: 'sites must be a list of site ids or null' });
     if (Array.isArray(sites) && !sites.length) return res.status(400).json({ error: 'Pick at least one site' });
     db.prepare('UPDATE users SET role = ?, sites = ? WHERE id = ?').run(role, sites ? JSON.stringify(sites) : null, u.id);
@@ -761,7 +761,20 @@ function setupAuth({ app, db, WEB_PASSWORD, API_KEY, rateLimited, clientIp, site
     res.json({ ok: true, username: who });
   });
 
-  return { auth, requireRole, siteAllowed, principal, audit };
+  /** a site created by a site-limited account becomes part of that account's list */
+  function grantSite(req, siteId) {
+    const p = req.principal;
+    if (!p || p.sites == null || !p.user) return;
+    const u = q.userById.get(p.user.id);
+    if (!u || u.sites == null) return;
+    const list = JSON.parse(u.sites);
+    if (!list.includes(siteId)) list.push(siteId);
+    db.prepare('UPDATE users SET sites = ? WHERE id = ?').run(JSON.stringify(list), u.id);
+    p.sites = list;
+  }
+  /** limited = can only see some sites (cloud customers, viewers with a site list) */
+  const isLimited = (req) => !!(req.principal && req.principal.sites != null);
+  return { auth, requireRole, siteAllowed, principal, audit, grantSite, isLimited };
 }
 
 // ── offline admin (CLI on the server, for lock-outs) ─────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tacilytics",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "description": "Privacy-first, cookieless analytics for websites and apps. Self-hosted: one Node process, one SQLite file.",
   "main": "server.js",
   "type": "commonjs",

package/public/account.js

@@ -163,7 +163,7 @@
 
   // ── settings ──
   var ROLE_LABEL = { owner: 'Owner', admin: 'Admin', viewer: 'Viewer' };
-  var ROLE_HELP = { owner: 'everything, including the team', admin: 'sites, share links and funnels', viewer: 'read only' };
+  var ROLE_HELP = { owner: 'everything, including the team', admin: 'sites, share links and funnels (all or picked sites)', viewer: 'read only' };
   var me = null;
   function setErr(t) { $('setErr').textContent = t || ''; }
   // footer version: only after sign-in (from /api/me), links to the release tag; strict format check so
@@ -183,6 +183,7 @@
       $('meName').textContent = m.username || 'Settings';
       showVersion(m.version);
       document.body.classList.toggle('role-viewer', m.role === 'viewer');
+      document.body.classList.toggle('site-limited', !!(m.sites && m.role !== 'owner')); // the operator adds their sites
     }).catch(function () {});
   }
   function openSettings(tab) {
@@ -418,15 +419,15 @@
         var self = me && me.id === u.id;
         return '<div class="set-row team-row" data-uid="' + u.id + '">' +
           '<span><strong data-no-i18n>' + esc(u.username) + '</strong>' + (self ? ' <span class="muted small">(you)</span>' : '') +
-          '<br><span class="muted small">' + (u.role === 'viewer' ? siteNames(u.sites) + ' · ' : '') + (u.totp ? '2FA on' : 'no 2FA') + (u.passkeys ? ' · ' + u.passkeys + ' passkey' + (u.passkeys > 1 ? 's' : '') : '') + ' · last sign-in ' + date(u.last_login) + '</span></span>' +
+          '<br><span class="muted small">' + (u.role !== 'owner' ? siteNames(u.sites) + ' · ' : '') + (u.totp ? '2FA on' : 'no 2FA') + (u.passkeys ? ' · ' + u.passkeys + ' passkey' + (u.passkeys > 1 ? 's' : '') : '') + ' · last sign-in ' + date(u.last_login) + '</span></span>' +
           '<select data-role>' + ['owner', 'admin', 'viewer'].map(function (r) { return '<option value="' + r + '"' + (r === u.role ? ' selected' : '') + '>' + ROLE_LABEL[r] + '</option>'; }).join('') + '</select>' +
-          '<span class="row-actions">' + (u.role === 'viewer' ? '<button class="btn ghost mini" data-sites>Sites</button>' : '') +
+          '<span class="row-actions">' + (u.role !== 'owner' ? '<button class="btn ghost mini" data-sites>Sites</button>' : '') +
           (!self ? '<button class="btn ghost mini" data-resetlink title="One-time link to set a new password (24 h)">Password link</button>' : '') +
           (u.totp && !self ? '<button class="btn ghost mini" data-reset2fa>Reset 2FA</button>' : '') +
           (!self ? '<button class="btn ghost danger mini" data-remove>Remove</button>' : '') + '</span></div>';
       }).join('');
       var invites = t.invites.map(function (i) {
-        return '<div class="set-row"><span>' + ico('i-user-plus') + ROLE_LABEL[i.role] + (i.role === 'viewer' ? ' · ' + esc(siteNames(i.sites)) : '') + '</span><span class="muted small">expires ' + date(i.expires) + '</span><button class="btn ghost danger mini" data-delinv="' + i.id + '">Revoke</button></div>';
+        return '<div class="set-row"><span>' + ico('i-user-plus') + ROLE_LABEL[i.role] + (i.role !== 'owner' ? ' · ' + esc(siteNames(i.sites)) : '') + '</span><span class="muted small">expires ' + date(i.expires) + '</span><button class="btn ghost danger mini" data-delinv="' + i.id + '">Revoke</button></div>';
       }).join('');
       el.innerHTML =
         '<div class="set-card"><h3>' + ico('i-users') + 'Members</h3>' + rows + '</div>' +
@@ -436,11 +437,11 @@
         '<div id="invSites">' + sitePicker('invPick', null) + '</div>' +
         '<div id="invOut"></div>' + (invites ? '<h4 class="muted small" style="margin-top:12px">Open invites</h4>' + invites : '') + '</div>';
 
-      $('invRole').onchange = function () { $('invSites').classList.toggle('hide', this.value !== 'viewer'); };
+      $('invRole').onchange = function () { $('invSites').classList.toggle('hide', this.value === 'owner'); };
       $('invCreate').onclick = function () {
         setErr('');
         var role = $('invRole').value;
-        call('POST', '/api/team/invites', { role: role, sites: role === 'viewer' ? pickedSites('invPick') : null }).then(function (r) {
+        call('POST', '/api/team/invites', { role: role, sites: role !== 'owner' ? pickedSites('invPick') : null }).then(function (r) {
           var url = location.origin + r.url;
           $('invOut').innerHTML = '<div class="snippet" id="invUrl">' + esc(url) + '</div><button class="btn ghost" id="invCopy">Copy link</button>';
           $('invCopy').onclick = function () { navigator.clipboard.writeText(url); $('invCopy').textContent = 'Copied ✓'; };

package/public/i18n.js

@@ -142,7 +142,7 @@
     'For scripts, agents and the CLI (': 'Für Skripte, Agents und die CLI (',
     '). A key acts as you, sees only your sites, and cannot touch the team or your security settings. Read-only unless you untick it.': '). Ein Key handelt als du, sieht nur deine Seiten und kann weder das Team noch deine Sicherheitseinstellungen ändern. Nur lesen, außer du nimmst den Haken raus.',
     'Signed in as': 'Angemeldet als',
-    'Viewer — read only': 'Viewer: nur lesen', 'Admin — sites, share links and funnels': 'Admin: Seiten, Share-Links und Funnels', 'Owner — everything, including the team': 'Owner: alles, auch das Team',
+    'Viewer — read only': 'Viewer: nur lesen', 'Admin — sites, share links and funnels (all or picked sites)': 'Admin: Seiten, Share-Links und Funnels (alle oder ausgewählte Seiten)', 'Owner — everything, including the team': 'Owner: alles, auch das Team',
     'In Plausible:': 'In Plausible:', 'Site settings → Imports & Exports → Export data': 'Website-Einstellungen → Imports & Exports → Export data',
     '. Upload the ZIP you get (or the CSV files in it).': '. Lade das ZIP hoch (oder die CSV-Dateien darin).',
     'In Google Analytics 4: open a report (e.g.': 'In Google Analytics 4: Öffne einen Bericht (z. B.', 'Pages and screens': 'Seiten und Bildschirme', 'Traffic acquisition': 'Akquisition von Zugriffen',

package/public/style.css

@@ -451,6 +451,7 @@ select option { background: #0c1a1d; color: var(--text); }
 #login .btn.ghost .ico, #settingsBtn .ico { margin-right: 6px; }
 /* viewers: hide everything that would only answer with 403 */
 body.role-viewer #addSiteBtn, body.role-viewer #shareBtn, body.role-viewer #addFunnelBtn { display: none !important; }
+body.site-limited #addSiteBtn { display: none !important; }
 @media (max-width: 560px) { #meName { display: none; } .team-row { flex-wrap: wrap; } }
 a.btn, a.btn:hover { text-decoration: none; display: inline-flex; align-items: center; gap: 6px; color: var(--text); }
 .swatch.ann { width: 9px; height: 9px; transform: rotate(45deg); border-radius: 1px; background: var(--accent-2, #ff7a5c); }

package/public/tacilytics.js

@@ -4,6 +4,11 @@
 
    Optional data-* flags on the <script> tag:
      data-honor-dnt        respect Do-Not-Track / Global Privacy Control (skip all tracking)
+     data-strict           strict mode: no localStorage, no timezone, no language, no window/screen size,
+                           no DNT lookup in JS (only document.visibilityState and Date.now() differences for
+                           time on page, never sent). Language comes from the Accept-Language header,
+                           DNT/GPC from the request headers (with data-honor-dnt). Costs: no country, no scroll
+                           depth, ?tacilytics=off does not work (exclude own visits another way).
      data-track-outbound   auto-record clicks on links to other domains as events
      data-track-downloads  auto-record file downloads as "File Download" events (optional value: "pdf,zip,…")
      data-track-404        record a "404" event when the page is an error page
@@ -20,15 +25,19 @@
     var domain = s && s.getAttribute('data-domain');
     if (!s || !domain) return;
 
+    var strict = s.hasAttribute('data-strict');
+    var honorDnt = s.hasAttribute('data-honor-dnt');
+
     // Privacy signals (opt-in): if the visitor asked not to be tracked, honour it and do nothing.
-    if (s.hasAttribute('data-honor-dnt')) {
+    // In strict mode the server checks the DNT / Sec-GPC request headers instead (nothing is read here).
+    if (honorDnt && !strict) {
       var dnt = navigator.doNotTrack || window.doNotTrack || navigator.msDoNotTrack;
       if (navigator.globalPrivacyControl === true || dnt === '1' || dnt === 'yes') return;
     }
 
     // "Don't count this browser" (your own visits): open the site once with ?tacilytics=off
     // (?tacilytics=on counts it again). Remembered per browser in localStorage, nothing is sent.
-    try {
+    if (!strict) try {
       var optParam = new URLSearchParams(location.search).get('tacilytics');
       if (optParam === 'off') { localStorage.setItem('tacilytics_ignore', '1'); console.info('Tacilytics: this browser is no longer counted on ' + location.hostname + ' (undo: ?tacilytics=on)'); }
       else if (optParam === 'on') { localStorage.removeItem('tacilytics_ignore'); console.info('Tacilytics: this browser is counted again on ' + location.hostname); }
@@ -37,11 +46,17 @@
         return;
       }
     } catch (e) {} // storage blocked → just count normally
+    else if (/[?&]tacilytics=(off|on)(&|$)/.test(location.search)) {
+      // the query string is part of the page address, not the device
+      try { console.info('Tacilytics: strict mode, ?tacilytics=off/on is not supported (it needs localStorage)'); } catch (e) {}
+    }
 
     var endpoint = new URL(s.src).origin + '/api/collect';
-    var tz = '';
-    try { tz = Intl.DateTimeFormat().resolvedOptions().timeZone || ''; } catch (e) {}
-    var lang = (navigator.language || '').slice(0, 12);
+    var tz = '', lang = '';
+    if (!strict) {
+      try { tz = Intl.DateTimeFormat().resolvedOptions().timeZone || ''; } catch (e) {}
+      lang = (navigator.language || '').slice(0, 12);
+    }
     var qs = new URLSearchParams(location.search);
     var first = true;
 
@@ -68,6 +83,7 @@
         um: qs.get('utm_medium') || '',
         uc: qs.get('utm_campaign') || '',
       };
+      if (strict) { payload.st = 1; if (honorDnt) payload.hd = 1; }
       if (name) { payload.n = name; if (props && typeof props === 'object') payload.pr = props; }
       else first = false;
       post(payload);
@@ -77,6 +93,7 @@
     var acc = 0, since = (document.visibilityState === 'visible') ? Date.now() : 0, engPath = location.pathname;
     var maxScroll = 0;
     function measureScroll() {
+      if (strict) return; // window and screen size are device information
       var de = document.documentElement, b = document.body || de;
       var h = Math.max(de.scrollHeight, b.scrollHeight), vh = window.innerHeight || de.clientHeight;
       var y = window.pageYOffset || de.scrollTop || 0;
@@ -91,7 +108,11 @@
     function flushEngagement() {
       var secs = engaged();
       measureScroll();
-      if (secs >= 1 || maxScroll > 0) post({ d: domain, p: engPath, e: 'engagement', dur: secs, sc: maxScroll });
+      if (secs >= 1 || maxScroll > 0) {
+        var eb = { d: domain, p: engPath, e: 'engagement', dur: secs };
+        if (strict) { eb.st = 1; if (honorDnt) eb.hd = 1; } else eb.sc = maxScroll;
+        post(eb);
+      }
     }
     function resetEngagement() { acc = 0; since = Date.now(); engPath = location.pathname; maxScroll = 0; }
     document.addEventListener('visibilitychange', function () {

package/server.js

@@ -143,6 +143,8 @@ db.exec(`
 const norm = (d) => String(d || '').toLowerCase().replace(/^www\./, '').replace(/\/.*$/, '').trim();
 // per-site time zone (Fabian): only query boundaries move, stored days stay UTC (Tyto). Old installs → 'UTC'.
 if (!db.prepare('PRAGMA table_info(sites)').all().some((c) => c.name === 'timezone')) db.exec("ALTER TABLE sites ADD COLUMN timezone TEXT NOT NULL DEFAULT 'UTC'");
+// paused sites collect nothing (hosting: trial over / subscription ended). Only an unlimited admin or owner can pause.
+if (!db.prepare('PRAGMA table_info(sites)').all().some((c) => c.name === 'paused')) db.exec('ALTER TABLE sites ADD COLUMN paused INTEGER NOT NULL DEFAULT 0');
 const getSiteByDomain = db.prepare('SELECT * FROM sites WHERE domain = ?');
 const insSite = db.prepare("INSERT OR IGNORE INTO sites (domain, name, created, timezone) VALUES (?, ?, ?, COALESCE(?, 'UTC'))");
 const allSites = db.prepare('SELECT * FROM sites ORDER BY domain');
@@ -237,6 +239,11 @@ function parseUA(ua) {
 
 // Rough timezone → ISO country (privacy-preserving alternative to IP geo).
 const TZ_COUNTRY = require('./tz-country.js');
+// first language of an Accept-Language header ("de-DE,de;q=0.9,en;q=0.8" → "de-DE"), or null
+function acceptLang(h) {
+  const m = String(h || '').split(',')[0].split(';')[0].trim().match(/^[A-Za-z]{1,8}(-[A-Za-z0-9]{1,8})?$/);
+  return m ? m[0].slice(0, 12) : null;
+}
 function countryFromTz(tz) { return (tz && TZ_COUNTRY[tz]) || null; }
 
 const { createDaySalt, dayStr } = require('./day-salt.js');
@@ -317,7 +324,7 @@ function collect(req, res) {
   const domain = norm(b.d || b.domain);
   if (!domain) return res.status(204).end();
   const site = getSiteByDomain.get(domain);
-  if (!site) return res.status(202).end(); // unknown site → silently ignore
+  if (!site || site.paused) return res.status(202).end(); // unknown or paused site → silently ignore
   const platform = appPlatform(b);
   // apps: the HTTP client's user agent says nothing about the device, so OS/device come from the beacon.
   // A bot-looking UA is still dropped, so the bot filter cannot be bypassed by just adding `pf`.
@@ -328,6 +335,10 @@ function collect(req, res) {
     ua = { browser: 'App', os: APP_PLATFORMS[platform], device: dv === 'tablet' ? 'Tablet' : dv === 'desktop' ? 'Desktop' : (platform === 'android' || platform === 'ios') ? 'Mobile' : 'Desktop' };
   }
   if (!ua) return res.status(204).end(); // bot
+  // strict mode (data-strict): the tracker read nothing on the device. Privacy signals and language come
+  // from headers the browser sends with every request anyway.
+  const strict = String(b.st || '') === '1';
+  if (strict && String(b.hd || '') === '1' && (req.headers['dnt'] === '1' || req.headers['sec-gpc'] === '1')) return res.status(204).end();
 
   const ts = Date.now();
   const day = dayStr(ts);
@@ -350,7 +361,7 @@ function collect(req, res) {
   // engagement beacon: attach a visit duration (+ max scroll depth) to the visitor's latest pageview (no new row).
   if (b.e === 'engagement') {
     const dur = Math.max(0, Math.min(7200, parseInt(b.dur, 10) || 0)); // cap at 2h
-    const sc = b.sc == null || b.sc === '' ? null : Math.max(0, Math.min(100, parseInt(b.sc, 10) || 0));
+    const sc = strict || b.sc == null || b.sc === '' ? null : Math.max(0, Math.min(100, parseInt(b.sc, 10) || 0));
     if (dur > 0 || sc != null) updDur.run({ site_id: site.id, vh, path: pth, dur, scroll: sc, since: ts - 6 * 3600000 });
     return res.status(204).end();
   }
@@ -365,8 +376,8 @@ function collect(req, res) {
   }
   const utmMedium = String(b.um || b.utm_medium || '').slice(0, 60).trim() || null;
   const utmCampaign = String(b.uc || b.utm_campaign || '').slice(0, 80).trim() || null;
-  const tz = String(b.tz || '').slice(0, 60) || null;
-  const lang = String(b.l || b.lang || '').slice(0, 12).split(',')[0] || null;
+  const tz = strict ? null : (String(b.tz || '').slice(0, 60) || null);
+  const lang = strict ? acceptLang(req.headers['accept-language']) : (String(b.l || b.lang || '').slice(0, 12).split(',')[0] || null);
   const name = String(b.n || b.name || '').slice(0, 80).trim() || null; // custom event / goal
   const props = name ? sanitizeProps(b.pr) : null; // properties only attach to named events
   let country = countryFromTz(tz);
@@ -386,7 +397,7 @@ app.get('/api/collect', collect);
 
 // ── auth: accounts, team, optional 2FA + passkeys (auth.js) ───────────────────
 const { setupAuth } = require('./auth');
-const { auth, requireRole, siteAllowed, audit } = setupAuth({
+const { auth, requireRole, siteAllowed, audit, grantSite, isLimited } = setupAuth({
   app, db, WEB_PASSWORD, API_KEY, rateLimited, clientIp,
   allSiteIds: () => db.prepare('SELECT id FROM sites').all().map((r) => r.id),
 });
@@ -411,6 +422,9 @@ function newToken() { return crypto.randomBytes(24).toString('hex'); }
 // ── sites management ─────────────────────────────────────────────────────────
 const sitesListHandler = (req, res) => res.json(allSites.all().filter((st) => siteAllowed(req, st.id)));
 const sitesCreateHandler = (req, res) => {
+  // a site-limited account (a hosting customer) never creates sites itself: the operator does, because sites are what
+  // is billed and paused. Otherwise a paused customer could add a fresh, unpaused site and move the snippet (Kiro, 2.3.0).
+  if (isLimited(req)) return res.status(403).json({ error: 'Your role does not allow this' });
   const rawDomain = norm(req.body && req.body.domain);
   let domain = rawDomain;
   let displayName = rawDomain; // keep Unicode original for a readable display name (e.g. ernährungs-plan.de)
@@ -423,7 +437,17 @@ const sitesCreateHandler = (req, res) => {
   const rawTz = req.body && req.body.timezone;
   const timezone = rawTz == null || rawTz === '' ? null : TZ.validTz(String(rawTz));
   if (rawTz != null && rawTz !== '' && !timezone) return res.status(400).json({ error: 'Unknown time zone' });
-  insSite.run(domain, (req.body && req.body.name) || displayName, Date.now(), timezone);
+  const existing = getSiteByDomain.get(domain);
+  if (existing) {
+    // an account limited to some sites must never get a foreign site back (or added to its list) by naming its domain
+    if (!siteAllowed(req, existing.id)) return res.status(409).json({ error: 'This domain is already registered' });
+    return res.json(existing);
+  }
+  const info = insSite.run(domain, (req.body && req.body.name) || displayName, Date.now(), timezone);
+  // defensive: if INSERT OR IGNORE did nothing (e.g. a second process sharing the DB won the domain), lastInsertRowid is
+  // stale and must never be granted. Not reachable over HTTP in one process (the handler is synchronous), so no test.
+  if (!info.changes) return res.status(409).json({ error: 'This domain is already registered' });
+  grantSite(req, Number(info.lastInsertRowid));
   audit(res, 'site.add', domain);
   res.json(getSiteByDomain.get(domain));
 };
@@ -435,15 +459,27 @@ app.patch('/api/sites/:id', adminOnly, (req, res) => {
   if (!siteAllowed(req, id)) return res.status(403).json(NO_SITE);
   const site = db.prepare('SELECT * FROM sites WHERE id = ?').get(id);
   if (!site) return res.status(404).json({ error: 'Unknown site' });
-  const timezone = TZ.validTz(String((req.body && req.body.timezone) || ''));
-  if (!timezone) return res.status(400).json({ error: 'Unknown time zone' });
-  db.prepare('UPDATE sites SET timezone = ? WHERE id = ?').run(timezone, id);
-  if (timezone !== site.timezone) audit(res, 'site.timezone', site.domain + ': ' + site.timezone + ' → ' + timezone);
+  const b = req.body || {};
+  if (b.paused !== undefined) {
+    // pausing is the operator's switch (hosting: trial or subscription ended), never the customer's
+    if (isLimited(req)) return res.status(403).json({ error: 'Your role does not allow this' });
+    const paused = b.paused ? 1 : 0;
+    db.prepare('UPDATE sites SET paused = ? WHERE id = ?').run(paused, id);
+    if (paused !== site.paused) audit(res, paused ? 'site.pause' : 'site.resume', site.domain);
+  }
+  if (b.timezone !== undefined || b.paused === undefined) {
+    const timezone = TZ.validTz(String(b.timezone || ''));
+    if (!timezone) return res.status(400).json({ error: 'Unknown time zone' });
+    db.prepare('UPDATE sites SET timezone = ? WHERE id = ?').run(timezone, id);
+    if (timezone !== site.timezone) audit(res, 'site.timezone', site.domain + ': ' + site.timezone + ' → ' + timezone);
+  }
   res.json(db.prepare('SELECT * FROM sites WHERE id = ?').get(id));
 });
 app.delete('/api/sites/:id', adminOnly, (req, res) => {
   const id = Number(req.params.id);
   if (!siteAllowed(req, id)) return res.status(403).json(NO_SITE);
+  // hard delete frees the domain and resets usage: only the operator (unlimited admin/owner) may do it (Tyto/Kiro, 2.3.0)
+  if (isLimited(req)) return res.status(403).json({ error: 'Your role does not allow this' });
   const gone = db.prepare('SELECT domain FROM sites WHERE id = ?').get(id);
   audit(res, 'site.remove', gone ? gone.domain : '#' + id);
   db.prepare('DELETE FROM events WHERE site_id = ?').run(id);
@@ -464,12 +500,78 @@ app.get('/api/v1', (_req, res) => res.json({
     'POST /api/v1/sites': 'add a site { domain }',
     'GET /api/v1/stats?site=&period=': 'aggregated stats (period: today|7d|30d|90d|12mo, or from=YYYY-MM-DD&to=YYYY-MM-DD)',
     'GET /api/v1/realtime?site=': 'online count, last-30-min pulse + recent events',
+    'GET /api/v1/usage?month=YYYY-MM': 'page views per site in a calendar month (UTC), owner / server key only',
+    'POST /api/v1/hit': 'server mode: report a page view from your web server { domain, path, ip, ua, referrer?, lang?, purpose?, name? } (write key)',
   },
   filters: 'add any of country,source,page,browser,os,device,lang,medium,campaign,goal to /stats to segment',
 }));
 app.get('/api/v1/sites', auth, sitesListHandler);
+// page views per site in one calendar month (UTC), for hosting volume checks. Operator only:
+// owners or the server API key with access to all sites, never a site-limited account.
+app.get('/api/v1/usage', requireRole('owner'), (req, res) => {
+  if (isLimited(req)) return res.status(403).json({ error: 'Your role does not allow this' });
+  const m = String(req.query.month || new Date().toISOString().slice(0, 7));
+  if (!/^\d{4}-(0[1-9]|1[0-2])$/.test(m)) return res.status(400).json({ error: 'month must be YYYY-MM' });
+  const from = Date.UTC(+m.slice(0, 4), +m.slice(5, 7) - 1, 1), to = Date.UTC(+m.slice(0, 4), +m.slice(5, 7), 1);
+  res.json(db.prepare('SELECT s.id site_id, s.domain, COUNT(e.id) pageviews FROM sites s LEFT JOIN events e ON e.site_id = s.id AND e.ts >= ? AND e.ts < ? AND e.name IS NULL GROUP BY s.id ORDER BY s.id').all(from, to));
+});
 app.post('/api/v1/sites', adminOnly, sitesCreateHandler);
 
+// ── server mode (2.4): the website's own server reports a page view, no script on the visitor's device ──
+// The site's backend forwards what the visitor's request carried anyway: path, Referer, Accept-Language,
+// User-Agent and the visitor IP. The IP is only taken from an authenticated write key (never from the
+// public /api/collect), otherwise anyone could feed arbitrary IPs into the visitor hash. It is hashed
+// exactly like a tracker hit and never stored.
+const net = require('net');
+const PREFETCH_RE = /prefetch|prerender/i;
+// write access needed (admin role or a non-read-only key); a read-only key is a viewer and gets 403
+app.post('/api/v1/hit', adminOnly, (req, res) => {
+  if (rateLimited('h:' + clientIp(req), 6000, 60000)) return res.status(429).json({ error: 'Too many hits' });
+  const b = req.body || {};
+  const domain = norm(b.domain || b.d);
+  const site = domain && getSiteByDomain.get(domain);
+  if (!site || !siteAllowed(req, site.id)) return res.status(404).json({ error: 'Unknown site' });
+  if (site.paused) return res.status(202).end();
+  const ip = String(b.ip || '').trim();
+  // without the visitor IP every visitor would fall onto one hash: refuse instead of counting wrong
+  if (!net.isIP(ip)) return res.status(400).json({ error: 'ip (the visitor IP) is required for server mode' });
+  // prefetch / prerender requests are not visits (Sec-Purpose / Purpose header of the visitor request)
+  if (PREFETCH_RE.test(String(b.purpose || ''))) return res.status(204).end();
+  const rawUa = String(b.ua || '').slice(0, 512);
+  const ua = parseUA(rawUa);
+  if (!ua) return res.status(204).end(); // bot, crawler, monitor or no user agent
+  if (b.dnt === true || b.dnt === '1' || b.gpc === true || b.gpc === '1') return res.status(204).end(); // forwarded DNT / GPC (opt-in on the sending side)
+
+  const ts = Date.now();
+  const day = dayStr(ts);
+  let url;
+  try { url = new URL(String(b.path || b.p || '/').slice(0, 1024), 'http://x'); } catch { return res.status(400).json({ error: 'invalid path' }); }
+  let pth = url.pathname.slice(0, 512);
+  try { pth = decodeURI(pth); } catch {}
+  if (pth.length > 1) pth = pth.replace(/\/+$/, '') || '/';
+  const vh = visitorHash(site.id, ip, rawUa, day);
+  const intern = INTERNAL_PATHS[domain] || [];
+  if (intern.some((pre) => pth.startsWith(pre))) { insInternal.run(site.id, vh, day); return res.status(204).end(); }
+  if (isInternal.get(site.id, vh, day)) return res.status(204).end();
+
+  const referrer = String(b.referrer || b.r || '').slice(0, 512);
+  const q = url.searchParams;
+  let source = 'Direct';
+  const utm = String(q.get('utm_source') || q.get('ref') || '').slice(0, 60).trim();
+  if (utm) source = utm;
+  else if (referrer) { try { const h = norm(new URL(referrer).hostname); if (h && h !== domain) source = h; } catch {} }
+  const name = String(b.name || b.n || '').slice(0, 80).trim() || null; // optional server-side goal (e.g. Purchase)
+  insEvent.run({
+    site_id: site.id, ts, day, path: pth, source, referrer: referrer || null,
+    country: null, tz: null, browser: ua.browser, os: ua.os, device: ua.device,
+    lang: acceptLang(b.lang), name,
+    utm_medium: String(q.get('utm_medium') || '').slice(0, 60).trim() || null,
+    utm_campaign: String(q.get('utm_campaign') || '').slice(0, 80).trim() || null,
+    dur: null, props: name ? sanitizeProps(b.props) : null, vh, platform: null, app_version: null,
+  });
+  res.status(204).end();
+});
+
 // ── stats ────────────────────────────────────────────────────────────────────
 const TZ = require('./tz');
 const PERIODS = { today: 1, '7d': 7, '30d': 30, '90d': 90, '12mo': 365 };
@@ -983,6 +1085,16 @@ app.get('/api/funnels/:id/stats', authOrShare, (req, res) => {
 });
 
 // ── static dashboard ─────────────────────────────────────────────────────────
+// Hosting (e.g. Tacilytics Cloud): DASHBOARD_EXTRA_SCRIPT="/cloud/ui.js" adds one same-origin script to the
+// dashboard page (trial/billing banner). Only a plain local path is accepted, never a URL to another host.
+const EXTRA_SCRIPT = /^\/[A-Za-z0-9._\/-]{1,120}$/.test(process.env.DASHBOARD_EXTRA_SCRIPT || '') && !/\.\.|\/\//.test(process.env.DASHBOARD_EXTRA_SCRIPT) ? process.env.DASHBOARD_EXTRA_SCRIPT : '';
+const INDEX_HTML = path.join(__dirname, 'public', 'index.html');
+function sendIndex(_req, res) {
+  if (!EXTRA_SCRIPT) return res.sendFile(INDEX_HTML);
+  const html = fs.readFileSync(INDEX_HTML, 'utf8').replace('</body>', `<script src="${EXTRA_SCRIPT}" defer></script>\n</body>`);
+  res.type('html').set('Cache-Control', 'no-cache').send(html);
+}
+app.get(['/', '/index.html'], sendIndex);
 app.use(express.static(path.join(__dirname, 'public')));
 // ── visitor journeys: session-based path transitions for a sankey flow ───────────
 // A "session" = one visitor's pageviews with < 30 min between them.
@@ -1093,7 +1205,7 @@ app.get('/api/alerts', auth, (req, res) => {
   const site = getSiteByDomain.get(norm(req.query.site));
   if (!site) return res.status(404).json({ error: 'Unknown site' });
   if (!siteOk(req, site)) return res.status(403).json(NO_SITE);
-  res.json({ fallbackWebhook: !!DIGEST_WEBHOOK_URL, alerts: db.prepare('SELECT * FROM alerts WHERE site_id = ? ORDER BY id').all(site.id).map((a) => publicAlert(a, site.domain)) });
+  res.json({ fallbackWebhook: !!DIGEST_WEBHOOK_URL && !isLimited(req), alerts: db.prepare('SELECT * FROM alerts WHERE site_id = ? ORDER BY id').all(site.id).map((a) => publicAlert(a, site.domain)) });
 });
 app.post('/api/alerts', adminOnly, async (req, res) => {
   const b = req.body || {};
@@ -1118,7 +1230,10 @@ app.post('/api/alerts', adminOnly, async (req, res) => {
     if (prob) return res.status(400).json({ error: prob });
     if (!(await webhookResolvesPublic(b.webhook, webhookLookup))) return res.status(400).json({ error: 'Webhook must point to a public address' });
     webhook = String(b.webhook);
-  } else if (!DIGEST_WEBHOOK_URL) return res.status(400).json({ error: 'Add a webhook URL (no default DIGEST_WEBHOOK_URL is set)' });
+  } else if (!DIGEST_WEBHOOK_URL || isLimited(req)) {
+    // the operator's webhook is for the operator: an account limited to some sites must bring its own
+    return res.status(400).json({ error: 'Add a webhook URL' + (DIGEST_WEBHOOK_URL ? '' : ' (no default DIGEST_WEBHOOK_URL is set)') });
+  }
   if (db.prepare('SELECT COUNT(*) n FROM alerts WHERE site_id = ?').get(site.id).n >= 20) return res.status(400).json({ error: 'At most 20 alerts per site' });
   const info = db.prepare('INSERT INTO alerts (site_id, kind, goal, threshold, window_hours, webhook, created) VALUES (?, ?, ?, ?, ?, ?, ?)')
     .run(site.id, b.kind, goal, threshold, windowHours, webhook, Date.now());
@@ -1173,7 +1288,7 @@ const validEmail = (e) => /^[^\s@<>",;]{1,64}@[^\s@<>",;]{1,190}\.[A-Za-z]{2,}$/
 const { createReport, REPORT_LANGS } = require('./report');
 const reporter = createReport(db);
 function buildReport(user, now) {
-  const sites = allSites.all().filter((st) => !user.sites || JSON.parse(user.sites).includes(st.id));
+  const sites = allSites.all().filter((st) => !st.paused && (!user.sites || JSON.parse(user.sites).includes(st.id)));
   return reporter.build(user, sites, now, { publicUrl: PUBLIC_URL, lang: REPORT_LANGS.includes(user.report_lang) ? user.report_lang : 'en' });
 }
 async function sendReport(user, now = Date.now()) {
@@ -1303,6 +1418,7 @@ const COOLDOWN = { spike: 6 * 3600e3, drop: 6 * 3600e3 };
 async function alertTick(now = Date.now()) {
   const fired = [];
   for (const site of allSites.all()) {
+    if (site.paused) continue; // a paused site collects nothing: a 'drop' alert would only announce the pause (Tyto, 2.3.0)
     const rules = db.prepare('SELECT * FROM alerts WHERE site_id = ? AND enabled = 1').all(site.id);
     const hasOwn = db.prepare('SELECT COUNT(*) n FROM alerts WHERE site_id = ?').get(site.id).n > 0;
     let verdict = null;
@@ -1353,6 +1469,6 @@ if (process.env.TACILYTICS_TEST_HOOKS === '1') {
 // unknown API paths are a 404 in JSON — never the SPA page. A client that asks an older/newer server for a
 // route it doesn't have must get an error it can show, not HTML it would try to read as data (Kiro, 2.2.0).
 app.all(/^\/(api|auth)(\/|$)/, (_req, res) => res.status(404).json({ error: 'Not found' }));
-app.get('*', (_req, res) => res.sendFile(path.join(__dirname, 'public', 'index.html')));
+app.get('*', sendIndex);
 
 app.listen(PORT, '127.0.0.1', () => console.log(`Tacilytics on http://127.0.0.1:${PORT}${RETENTION_DAYS ? ` · retention ${RETENTION_DAYS}d` : ''}${DIGEST_WEBHOOK_URL ? ` · digest ${DIGEST_HOUR_UTC}:00 UTC` : ''}`));