Changelog

September 10, 2026 · Source release, not deployed

Consent withdrawal, paid-channel checks and recorded MRR history

These changes are prepared in the source branches. They are not a confirmation that the production app or its scheduled worker has been updated.

• Consent withdrawal stops tag measurement, discards pending calls and clears accessible visitor cookies. Re-grant starts with a fresh id; activity from the denied period is not replayed. Consent-manager examples cover saved acceptance and withdrawal (docs).
• Meta's comparison now includes only Meta Ads. Bare fbclid and utm_source=meta without a paid medium are excluded. Only gclsrc=aw.ds maps to Google Ads. Captured parameters classify traffic; they do not independently prove an ad click (rules).
• MRR uses subscription observations available at the requested time. Missing history or unsupported pricing or currency returns unavailable, instead of applying today's price to the past (coverage).
• Retention covers crawls, search, supporting payment history, annotations and alert sends. A lapsed site's analytics deletion also removes spend and reports. Required subscription identities, opening MRR observations and the boundary month's crawl counter have explicit rolling-window exceptions (scope).
• The tag release build measures 9,930 bytes minified and 4,364 bytes gzipped (reference).

September 7, 2026

Payments found on the success page, Search Console, AI crawlers, and an API that covers the dashboard

• Stripe payments are detected on the success page with no code: the tag reports the Checkout Session id it finds in ?session_id=, the server reads the session with your own key, and only a paid session becomes an order, matched as session_param. Off with data-disable-payments="true"; data-checkout-param renames the parameter. One row per charge whichever way it arrives (docs).
• Google Search Console connects from the Revenue tab with its own read-only consent: 16 months on the first pull, the trailing week each day after, and a "What people searched for" panel with Google's clicks, impressions, click rate and position by term and by page, your own orders and revenue beside each page, and no revenue on a term (docs).
• AI crawlers: @datastated/crawl reports bot fetches from your own server (Next.js, Express, Hono, Cloudflare Workers or any fetch). Fifty named crawlers are sorted into AI answers, search indexing, AI training and other, checked against the provider's published addresses where it publishes them, with fetches of llms.txt, robots.txt and sitemaps counted. 100,000 hits a month per site, separate from events and never billed (docs, directory).
• The API exposes analytics and management resources with named permissions, a site list per key, rate-limit headers with a 429, an OpenAPI 3.1 document at /api/openapi.json and a playground in the app. The MCP server has one tool per endpoint, aliases for the six original names, datastated_help, and a dry run on anything destructive unless confirm: true. The CLI exposes catalogued commands, with --json and --yes (API, MCP, CLI).
• Consent gating: add data-require-consent to the snippet and the tag sets no cookie, writes nothing and sends nothing until your consent manager calls ds("consent", "granted"); then it sets the cookie, sends the pageview for the page on screen and replays any goals queued meanwhile. Global Privacy Control and Do Not Track still win. Callbacks for Cookiebot, OneTrust, Klaro and Osano, and a cookie-notice clause you can paste, are on the new consent page (docs).
• The privacy policy now names the one sessionStorage key the tag writes and lists every cookie app.datastated.com sets; the DPA gains California service-provider terms; datastated.com sets no cookies at all.
• Source work separated Google Ads, Meta Ads, TikTok Ads, Bing Ads, X Ads and LinkedIn Ads from organic search and social channels. The September 10 entry refines the Meta and gclsrc rules and explains the limits of captured click parameters (current rules).
• The September 7 source build measured 6,910 bytes minified. The September 10 entry records the newer build size (current reference).

September 5, 2026

Periods, filters with operators, funnels, identify, annotations, email, a public page, the managed proxy

• Ten period presets that a link can carry (?period=7d), hourly, daily and weekly charts picked from the range or set with ?grain=, a previous-period line behind the chart, and headline tiles for conversion rate, revenue per visitor, net revenue, MRR, new visitors, average visit and bounce rate, each shown only when the records can count it (docs).
• Filters take operators (is, is not, contains, does not contain, starts with, ends with, matches with *), several values at once, and new dimensions: term, content, referrer site, entry page, region, city, shop step, first or returning visit, and a goal with a property. They are judged per visitor, so a filtered view carries the people's orders with them (docs).
• Goals take properties, ds("goal", "signup", { plan: "pro" }), with a details panel per goal; ds("identify") and POST /api/sites/{domain}/identify attach your own user id and a hashed email, folding a second cookie for the same user into the first; and a site can rank every breakdown by one goal instead of revenue (docs).
• Funnels: two to eight ordered steps, counted per visitor in order, with drop-off and recorded order revenue at each step; a click on a step filters the page (docs).
• Notes on the chart, and commits synced from a GitHub repo with a read-only token and an optional prefix filter, drawn as marks at every grain and returned by the API as annotations (docs).
• A weekly summary email on Monday morning, after 08:00 in your timezone, and alerts within 15 minutes for orders, a named goal, or a traffic spike, capped at 25 a day (docs).
• A public read-only traffic page behind an unguessable link, money and search engines both off by default (docs).
• The ad-blocker proxy is managed: pick a subdomain, add one CNAME, wait for live, paste the snippet. HTTPS on the subdomain is switched on by us for now (docs).
• The window API adds series, goalProperties, annotations, and referrers, regions and cities when recorded; the events API takes props on goals. The tag is 6,213 bytes, about 6 KB (API, reference).

September 4, 2026

Stripe refunds, disputes and subscriptions, a sharper tag, claims in the API, retention

• Stripe: a webhook created from your own restricted key lands payments within seconds, with the six-hour pull as the backstop. Refunds and disputes are their own rows and the window carries refunds, disputed, disputesLost and netRevenue. Subscriptions record nine lifecycle events, one checkbox decides whether renewals count as revenue, and MRR is counted from Stripe's records. Each order says how it was matched to its visit (metadata, client_reference, session_param, email or none), and a thank-you page can hand its Checkout Session id to the events API (docs).
• The tag reads nine click ids (gbraid, wbraid, gclsrc, twclid and li_fat_id join fbclid, gclid, ttclid and msclkid), stays silent in automated browsers, records outbound link clicks and engaged time, so visit time, bounce rate and new versus returning come from the record, adds data-ds-scroll goals, data-hash-routing and data-allowed-hosts cross-domain linking, and is 5.5 KB (reference).
• The claims-versus-verified section is its own endpoint, GET /api/sites/{domain}/claims, an MCP tool, site_claims, and datastated claims <site> in the CLI (API).
• Retention is enforced: three years of history through the 200k plan, five from 500k up, swept nightly, and a lapsed site's event data is deleted 90 days after access ends. GET /api/sites reports retentionYears and dataDeletesAfter (docs).
• TikTok Ads connects with one click from the Revenue tab, like Meta and Google (docs).
• The events API takes refund, and an optional email that is hashed on arrival.

September 4, 2026

Docs for connecting Meta Ads, Google Ads and TikTok Ads

• Three new guides walk through each ad platform: the UTM template the tag recognises and why click ids alone are not enough on iOS, the one-click connect and the single read-only permission it asks for, what the gap panel and campaign tables show, why the platform's number and your own differ, and what to do when spend or orders are missing (Meta, Google, TikTok).
• TikTok's guide said, at the time, that one-click connect was rolling out and that until it arrived we would connect the account on request; it arrived on September 4.

August 28, 2026

Import your history, API keys in settings, TikTok Ads

• Import your history: upload the export from Plausible (their zip works as is), Fathom, Simple Analytics, Google Analytics, or any CSV with a date and visitors column, and the days before your tag existed fill in. Days your own tag tracked always win; imports never touch revenue (docs).
• API keys are now created on the site's Settings → API tab: name it, copy it once.
• The Team tab's copy was cut to about a third.
• TikTok Ads joined Google and Meta as a connector, example data included.

August 27, 2026

Buyer journeys, server-side events, and a faster dashboard

• Buyer journeys: click any recent buyer and walk their whole journey, first visit to purchase. Anonymous by design.
• Buying patterns: visit days before buying, first visit to first order, and the hours your money arrives.
• Server-side events API: record goals and orders from your own backend, out of reach of ad blockers (docs).
• Also: settings are tabs, a site switcher in the nav, filters with saved segments, subdomain tracking, and charts that mark today as unfinished.

August 26, 2026

Filters and saved segments

Filter visitor analytics by source, country, device, browser, operating system, page or goal. Filters follow the visitor, so “visitors from Meta on mobile” carries their orders and revenue with them. Save a filter you keep coming back to as a segment and it becomes one click.

August 26, 2026

Subdomain tracking

Keep the same snippet on every subdomain and they count as one site: a visitor who reads blog. and buys on app. is one journey. Nothing to configure.

August 26, 2026

Exclusions

Exclude paths (/admin/*) and your own IP addresses in site settings; excluded visits are never recorded and never count toward your plan. For one browser, the tag also honours localStorage.datastated_ignore.

August 26, 2026

The full UTM set, and the ref shorthand

utm_term and utm_content get their own tabs beside Campaigns, and ?ref=producthunt now counts as a source on its own, the way indie makers actually tag links (?via= and ?source= work too).

August 26, 2026

Goals without writing code

Put data-ds-goal="start-trial" on any element and every click counts as that goal, with an optional value. Works in any site builder that lets you set an attribute. Docs.

August 26, 2026

Installation id added to the tag

This release added a site-specific installation id to the snippet. Correction: a tracking request carrying that public id does not prove domain ownership. Use the server-checked DNS TXT record or homepage meta tag described in Get started.

August 26, 2026

Stripe revenue connection

Paste one read-only key and every new Stripe payment counts as verified revenue, deduplicated against Stripe’s own records. Pass the visitor id in the payment’s metadata and each payment inherits the journey that produced it. Docs.

August 26, 2026

MCP server and a public CLI

Connect Claude Code, Cursor or any MCP client to your analytics at app.datastated.com/api/mcp, or run npx datastated login and read your numbers from any terminal. Read-only, scoped to your sites, included on every plan. MCP docs · CLI docs.

August 26, 2026

Data Processing Agreement

A real DPA at datastated.com/dpa: the actual subprocessor list, the actual security measures, breach notice terms, applying automatically through the terms so there is nothing to sign.

August 25, 2026

Open for signup

DataStated is live. Create an account, paste one line, and your first visitors show up seconds later. 14-day trial with every feature on, no card. Setup lives in the dashboard as a checklist that ticks itself, and picking a plan is two questions and a recommendation, not a pricing-grid puzzle.

August 23, 2026

Shopify app

One install covers both halves: the pixel on your storefront and checkout, and every order straight from Shopify’s records, matched to the visit that produced it by the checkout’s own token. Nothing about your customers is read. Docs.

August 18, 2026

Journey attribution and platform claims

Journey counts show how many recorded orders a channel touched, started and closed. The current dashboard shows platform claims separately in What each platform claims; those reported figures do not trace to individual recorded journeys.

August 16, 2026

datastated.com

The marketing site goes up. Every claim on it was checked against what the product does.

August 14, 2026

Pricing that follows volume, nothing else

Eight plans from $9 to $299 a month, sized by monthly events. Every plan has every feature and unlimited team members. Going over the allowance does not lock your dashboard: recording continues up to the plan’s ceiling, and upgrading reveals retained held-back days. Events dropped beyond that ceiling cannot be recovered.