Using Tastatur

<script defer data-site="YOUR_SITE_KEY" src="https://tastatur.dev/t.js"></script>

defer keeps it off the critical path. The script is about 3.2 KB over the wire and makes one request per pageview. Visits from localhost, private network ranges and file: are ignored, so local development will not appear in your numbers.

tastatur('event', 'Signup')

tastatur('event', 'Signup', { props: { plan: 'pro', source: 'pricing-page' } })

If you call tastatur() from code that may run before the deferred script has loaded, add this stub first. It queues calls and replays them once the script is ready.

window.tastatur = window.tastatur || function () {
  (window.tastatur.q = window.tastatur.q || []).push(arguments)
}

tastatur('event', 'Purchase', {
  revenue: { amount: 4900, currency: 'EUR' },
  props:   { plan: 'growth' }
})

amount is in minor units, so 4900 is €49.00. A currency is required whenever an amount is sent: without one, a total would silently mix euros and yen.

To take control yourself, set data-auto="false" and call it from your router:

router.afterEach(() => tastatur('pageview'))

Steps use the same matchers as goals. A visitor counts at step 3 only if they reached it after step 2, which means someone who backtracks and returns is still counted correctly.

script-src https://tastatur.dev;
connect-src https://tastatur.dev;

script-src lets the browser fetch t.js; connect-src lets it send the beacon. The script needs no unsafe-inline, no unsafe-eval, and sets no cookie, so it does not interact with your cookie or frame policy at all.

curl -X POST https://tastatur.dev/api/event \
  -H 'Content-Type: application/json' \
  -H 'X-Forwarded-For: <the end user's IP>' \
  -H 'User-Agent: <the end user's user-agent>' \
  -d '{
        "s": "YOUR_SITE_KEY",
        "u": "https://example.com/checkout",
        "n": "Purchase",
        "v": 4900,
        "c": "EUR"
      }'

The endpoint answers 202 for everything, including a payload it rejected. That is deliberate: a distinguishable response would let anyone test which site keys are valid. Check your dashboard to confirm events are arriving.

<noscript>
  <img src="https://tastatur.dev/api/pixel?s=YOUR_SITE_KEY&u=https://example.com/"
       alt="" width="1" height="1" referrerpolicy="no-referrer-when-downgrade">
</noscript>

The u parameter has to be written per page, so this is most practical in a server-rendered layout where you can interpolate the current URL. Everything else behaves the same, including bot filtering and the opt-out check.

The script derives its endpoint from its own src, so proxying the script through your domain automatically proxies the events with it. Point a path on your site at this instance:

location /stats.js  { proxy_pass https://tastatur.dev/t.js; }
location /stats/api { proxy_pass https://tastatur.dev/api/event; }

<script defer data-site="YOUR_SITE_KEY" src="/stats.js"></script>

Raw IP addresses and user-agent strings are never written to the database, a log, or disk. A returning visitor is counted as a new visitor tomorrow, so a 30-day figure is the sum of 30 daily figures rather than a count of distinct people.

Cookies, precisely

We say this explicitly because "no cookies" is used loosely in this category. A login needs a session cookie; pretending otherwise would be nonsense rather than privacy. What matters is that nothing of ours reaches your visitors.