Privacy

Analytics & Tracking

The elah.dev website uses two analytics tools. Both are opt-in: nothing loads or sends data until you accept the consent banner, and neither runs if your browser sends a Do-Not-Track signal. The elah libraries themselves (@elah/core and the rest) contain no telemetry — this applies only to the marketing site.

What we track

PostHog — privacy-friendly product analytics: page views and a few interaction events (install-command copies, playground launches, export flow, and the PWA install prompt — pwa_install_prompt_shown, pwa_install_clicked, pwa_installed, pwa_install_dismissed). Reverse-proxied through /ingest so it is resilient to ad-blockers.
Reddit Pixel — fires a PageVisitevent on load and on client-side route changes, used to measure Reddit ad campaigns. The PWA install prompt above also maps to Reddit's conversion events (ViewContent, Lead, SignUp, and a Custom event for dismissals) — only a small metadata object is forwarded for each, never the full PostHog payload.

Environment variables

Each tool is inert unless its variable is set. All are NEXT_PUBLIC_ (exposed to the browser, as the client SDKs require) and are read from the repo-root .env — see .env.example.

NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN — PostHog project token.
NEXT_PUBLIC_POSTHOG_HOST — PostHog host (e.g. https://us.i.posthog.com).
NEXT_PUBLIC_REDDIT_PIXEL_ID — Reddit advertiser pixel id.

Leave any of them unset and that tool is never loaded — a clean way to run the site with no tracking at all.

On first visit a banner asks to accept or decline. Until you choose, PostHog is initialised opted-out and the Reddit pixel script is never injected — so no analytics network request happens pre-consent. Accepting opts PostHog in and loads the pixel; declining keeps both off. Your choice is stored in localStorage (elah-analytics-consent) and remembered on return.

If your browser sends Do-Not-Track, both tools stay off and the banner never appears — the signal is treated as a decline.

Changing your choice

Clearing the site's localStorage (or the elah-analytics-consent key) resets the banner on next load. Enabling Do-Not-Track in your browser disables both tools immediately. Also clearing elah-pwa-install-dismissed-until and elah-pwa-installed resets the install prompt banner described below.

Install & offline

elah.dev can be installed as an app on desktop and Android Chromium browsers. A small service worker at /sw.js registers for every visitor, regardless of your analytics choice — it is not tracking. It only stores an offline fallback page and the site logo, sends nothing anywhere, and can be removed at any time from your browser's DevTools (Application → Service Workers → Unregister).

The install banner itself only appears after you accept the consent banner above, so its ViewContent impression event is never sent before the Reddit pixel is loaded.

Self-hosting

If you deploy your own copy of the site, simply omit the three variables above and no analytics code runs. One known gap: PostHog capture in the AI topics API route (app/api/ai/topics/route.ts) is server-side and fires on that explicit action; it is not covered by the client consent gate.