Overview
Track visitors, pages, and events on your website with a single script tag.
Flowtag Analytics records what happens on your website — who visits, which pages they land on, where they came from, and what they do — using one script tag and no client-side configuration. This page explains the moving parts; the rest of this section covers each one in depth.
Core concepts
| Concept | Description |
|---|---|
| Tracker | An analytics project tied to one website domain. Its ID is what the script tag sends, and it scopes every session, event, and report. |
| Session | One visit. Opened when the tag first reaches the server, kept alive by pings, and closed after 30 minutes without activity. |
| Event | One recorded action inside a session — a pageview, a custom event, a scroll, a click, an input, or a JavaScript error. See Tracking. |
| Visitor | The person behind a session, identified by a cookie ID when cookies are consented to, and by a hashed IP otherwise. |
| Tag | A UTM parameter or ref value captured from the landing URL and stored on the session, used for attribution. |
How collection works
The tag runs a three-step loop. Understanding it explains most of what you see in your reports — and most of what you'd otherwise report as a bug.
- Handshake. On page load the tag posts the tracker ID, visitor ID, path, referrer, and UTM tags to the beacon. The server filters bots, checks that the tracker is active and within its plan limits, hashes the visitor's IP, and opens (or resumes) a session. It replies with a session ID and a short-lived envelope token. The first pageview is recorded here.
- Ping loop. Every 6 seconds, if the visitor is active, the tag queues a ping carrying the current path. When the path differs from the last recorded pageview, the server writes a new pageview — this is how single-page apps get per-route pageviews without any extra code. Pings also keep the session open and set its duration.
- Envelope. Queued events are batched and sent together roughly every 3 seconds, gzipped, and flushed immediately before a navigation that would unload the page. The envelope token is rotated every 3 minutes.
A visitor counts as active if they interacted within the last 2 minutes while the tab is visible and focused, or within the last 30 seconds if the tab is hidden or unfocused. Idle visitors stop pinging, so an open browser tab left overnight does not inflate your session durations.
What is collected
Flowtag collects the following without any configuration on your side:
| Data | Detail | Source |
|---|---|---|
| Pages | Path of each pageview, plus entry and exit paths per session | Handshake and ping loop |
| Referrers | The referring URL, or <direct> when there is none and <self> for self-referrals | document.referrer |
| UTM tags | utm_source, utm_medium, utm_campaign, utm_term, utm_content, and ref | Landing URL query string |
| Geography | Country only | Cloudflare edge geolocation header |
| Device | Browser, operating system, and device type | User-agent parsing |
| Interactions | Scroll depth, clicks, and input focus — never input values | Tag listeners, heavily throttled |
| Errors | Unhandled rejections, window.onerror, and failed resource loads | Tag error listeners |
| Custom events | Whatever you send with flowtag.capture() | Your code |
No other query parameters are captured, and no field values typed by visitors are ever recorded. See Tracking for the exact payload of each event type.
Visitor identity and consent
The tag works in two modes, and switches between them at runtime when you call
flowtag.consentCookies():
- With cookie consent — a random UUID is stored in a first-party cookie and used as the visitor ID, so returning visitors are recognised across sessions.
- Without cookie consent (cookieless) — no visitor ID is stored. Sessions are still recorded, and visitors are distinguished server-side by a salted hash of their IP address. The raw IP is never stored.
Consent defaults to off, and no ID cookie exists until you grant it. If you use
Google Tag Manager, leave data-gtagsync enabled and Flowtag will follow the
analytics_storage consent signal automatically.
Because cookieless visitors are identified by hashed IP, two people behind the same NAT can be counted as one visitor, and one person on a changing IP can be counted as several. Cookieless numbers are directionally correct, not exact.
Bot filtering
Every handshake and envelope is checked against a bot user-agent database, on both the payload's reported user agent and the request header. Requests that look like bots receive a normal-looking success response and are then silently discarded, so crawlers do not appear in your reports and do not consume your plan quota.
Tracker status
| Status | Description |
|---|---|
active | Collecting data normally. |
paused | The tag is told to stop; no new sessions or events are recorded. Existing data is untouched. |
suspended | Disabled by Flowtag for policy reasons. Behaves like paused and cannot be resumed from the Dashboard. |
You can pause and resume a tracker from the status control on the tracker's Dashboard without touching your website's code.
Plan limits
Two separate limits apply per organization per calendar month: sessions and events. They behave differently when reached:
- Session limit reached — new sessions are refused, so no new visits are recorded. Sessions already open keep working.
- Event limit reached — sessions still open, but incoming events are discarded.
The number of trackers per organization is also capped by plan: 1 on Starter, 10 on Pro, and unlimited on Enterprise. Session, event, and retention allowances are listed on the pricing page. When you hit a limit, the tracker Dashboard shows a banner naming the limit and the date it resets — the first day of the next month.
Data collection stops at the limit; it is not queued and backfilled later. If you are close to your allowance and expect a traffic spike, upgrade before it happens rather than after.
Creating a tracker
- In the Dashboard, go to Trackers and click New tracker.
- Enter a name in slug format (lowercase letters, numbers, and hyphens —
e.g.
my-site) and the domain you are tracking (e.g.example.com, with or without a protocol; it is stored without one). - Click Create.
Creating a tracker requires a verified email address and the tracker: create
permission in the organization.