Analytics & short links

Traffic and reading for every site without a cookie or a consent banner, and branded short links on your workspace’s own subdomain with click counts alongside.

Traffic#

A small beacon is injected into every HTML page at publish time. It reports a pageview, and when the page is left, how it was read — no cookie, no local storage, no cross-site identifier. Each site’s page shows views, unique visitors, views per day, top pages, referrers and devices over 7, 30 or 90 days.

Uniques are counted with a hash of the visitor’s IP, user agent and the site, salted with a value that changes every day and is never stored. The same person is one visitor within a day and indistinguishable across days; there is nothing to subject-access, because nothing identifies anyone. Known bots are excluded. Events are kept for 90 days.

curl -H "Authorization: Bearer $COLOPHON_TOKEN" \
  "https://api.usercontent.colophon.fyi/api/v1/stats/sites/<site_id>?range=30d"

Time on page and scroll depth#

When a reader leaves a page — closes it, switches tab, locks the phone — the beacon sends two numbers: how many seconds the page was the visible tab, and how far down it got, as a quarter of its height (25, 50, 75 or 100%). A tab left open in the background counts nothing, a view stops counting at 30 minutes, and a reader who comes back to the page sends only the time since. The site’s Reading card, the stats API’s engagement and the MCP tool site_stats show, per page and for the site, the median time and how many reads got each quarter of the way down. A read is one visitor on one page in a day, recognised by the same daily hash as uniques.

That is all it measures. No mouse movement, no clicks, no keystrokes, no text selected, no screen size, no session across pages and no new identifier: the two numbers travel with the site, the path and the daily hash and nothing else, and are kept 90 days with every other event.

Named readers#

A restricted or private site already knows who opened it: the reader signed in at the gate (Who opened it). On those sites alone, the same report is also added to that reader’s receipt, so Opened by can say “read 4 min, scrolled to 100%”. The receipt keeps only the running total and the furthest depth, never the reports one by one, and the anonymous count is never joined to it. Public, unlisted and password sites name nobody, and nothing in their traffic is tied to a person.

Short links#

A short link is a code on your workspace’s subdomain that redirects to any public URL: https://acme.usercontent.colophon.fyi/l/q3. Create them under Links or with the CLI:

colophon link https://example.com/report --code q3 --title "Q3 report"

• Codes are 3–32 characters of a-z, 0-9 and -, cannot be all digits, and cannot be a path the platform uses itself. Leave --code off for a random six-character one.
• An optional expiry is a date, in UTC, through the end of that day.
• Targets must resolve to a public address and are checked against Safe Browsing before the link is created. A flagged target still takes the code, so it cannot be re-issued, but the link answers 410.
• Every click reaches the server — redirects are never cached — so disabling or enabling a link takes effect on the very next click. A disabled link can be enabled again under Links; its code is never handed out to another link.

Clicks over the last seven days appear next to each link in the dashboard, and each click is an event in the same analytics store as pageviews.