v0.0.5
Cookieless identity
Visitors who decline cookies are now countable — without anyone being persistently identified.
When a visitor rejects consent, the client stores nothing on the device and sends no identity at all. The server instead derives an ephemeral id from transport facts the request already carries:
cookieless-<base64url(HMAC-SHA256(salt_of_the_day, project ‖ ip ‖ user_agent))>
IP and user agent are hash inputs only — never stored, never returned by any API. The salt rotates daily and is held only in memory with a TTL; once it expires, that day's hashes are unlinkable to any IP or user agent by anyone, including us. Sessions are stitched server-side on a 30-minute inactivity window.
What this changes in your analytics
Cookieless ids rotate at midnight, so counting them as people would inflate your numbers. InsightQuerySpec gains an include_cookieless toggle, default off:
| Cookieless traffic | |
|---|---|
| Unique users, per-user average | excluded by default |
| Funnel, retention, user flow, top-K by user | excluded by default |
| Total event counts | always counted |
| All session metrics | always counted |
| Sum / avg / min / max aggregations | always counted |
Flip the toggle on when you want the full picture and accept that a returning visitor counts once per day. Both toggle states are served from the pre-aggregated rollup, so neither is the slow path.
Migration
ClickHouse migration 011 adds a rollup key column. No backfill — it applies to an existing table in place and runs as an ArgoCD PreSync hook ahead of the rollout.
Also in this release
- Invite controls — resends are capped at 10 per rolling 24h window (counting the original), and admins can now revoke a pending invitation. Revoking hard-deletes the record and invalidates any link already sitting in the invitee's inbox, which makes it the way to fix a typo'd address or a wrong role. (#59)
- Email idempotency — dispatch is keyed per send, so a retried delivery can no longer double-send, and provider-side idempotency conflicts are acknowledged rather than dead-lettered. (#59)
- Pie chart tiles — a new dashboard tile view mode. (#60)
- Ingestion observability — batches now report dropped events with a per-reason breakdown, so a partial failure is visible and actionable instead of silent.
- Dependency updates across Go modules and CI actions. (#53, #54, #56, #57, #58, #62)
Compatibility
No client upgrade is required. Existing SDKs keep working unchanged — the wire changes are additive, and every SDK uses the Connect binary codec, which ignores fields it doesn't know. Cookieless mode itself needs a forthcoming SDK release to opt into; until then this release is a no-op for existing traffic.
One thing to know if you mint your own identifiers: distinct_id and external_id may no longer begin with cookieless-, which is now a reserved server-owned prefix. A batch containing such an id is rejected.
New contributors
- @boramuyar made their first contribution in #60 — thank you!
Full Changelog: v0.0.4...v0.0.5
