Website Tracker

Add one script tag to your site and watch your visitors' journeys appear as a living process map — pages, forms, clickouts, and the paths between them. No cookies, no consent banner required in the default mode.

Install

Add this to your site's <head>, using the tracker ID from Workspace → Data → API Keys (create a key with type "Website Tracker"):

<script src="https://flowmyna.com/fm.js?t=YOUR_TRACKER_ID" defer></script>

That's it. Pageviews, call-to-action clicks, form starts/submissions, outbound links, and file downloads are captured automatically, and every visit becomes a Session you can explore, filter, and ask the copilot about.

If you call FlowMyna.capture() or FlowMyna.identify() in code that may run before the script loads, add the stub above the script tag so early calls queue instead of failing:

<script>
  window.FlowMyna = window.FlowMyna || {
    q: [],
    capture: function () { this.q.push(['capture', arguments]) },
    identify: function () { this.q.push(['identify', arguments]) },
  }
</script>

To verify the install: browse a few pages of your site, then open the tracker's dataset in Flow Myna — your session should appear within seconds.

What gets captured

Event names are deliberately a small, meaningful vocabulary — every event type becomes a step on your process map:

Viewed /pricing — pageviews, one event type per (normalized) page path
Clickout: Book a Demo — outbound links, mailto:, tel:, and file downloads
Form Started / Form Submitted — form interactions (field names only; values are never captured, and fields that look sensitive are excluded)
Anything you capture yourself: FlowMyna.capture('Trial Activated', { plan: 'team' })

Clicks on internal navigation don't create noise events — the clicked element rides along as navigation_source on the next pageview, so the map shows which button took visitors where.

Each Session carries the analytical dimensions you'd expect from a web-analytics tool, derived server-side: entry and exit page, traffic source and channel (Direct, Organic Search, Organic Social, Referral, Email, Paid, AI Assistants), UTM parameters, device class, browser, operating system, and country/region/city.

Configuration

All configuration is optional, via attributes on the script tag:

Attribute	Effect
`data-exclude-urls="/app,/admin"`	Never track pages under these path prefixes
`data-path-patterns="/blog/,/product/"`	Collapse dynamic paths into one map step ("Viewed /blog/*" instead of a step per post)
`data-privacy-mode="identify"`	Opt into persistent visitor identity (see Privacy modes)
`data-auto-track="false"`	Disable autocapture; only manual `capture()` calls are recorded
`data-respect-dnt`	Also honor the legacy Do-Not-Track signal (Global Privacy Control is always honored)

To exclude your own visits on your own machine, run this once in your browser console: localStorage.setItem('fm_ignore', 'true').

Privacy modes

Cookieless (the default)

The tracker stores nothing in the visitor's browser — no cookies, no localStorage, nothing. Visitors are recognized server-side through a salted hash that is rotated and deleted daily, so:

full journeys within a visit, and repeat visits within the same day, are stitched together;
no one can be recognized across days, and raw IP addresses and browser signatures are never stored;
no consent banner is required for this mode under GDPR/ePrivacy, on the same legal footing as other cookieless analytics tools.

The trade-off is deliberate: no returning-visitor or retention analysis in this mode.

Identify mode (opt-in)

Calling FlowMyna.identify('user-123', { plan: 'team' }) — or setting data-privacy-mode="identify" — switches to persistent identity: a visitor ID is stored in localStorage, Sessions link to your User records, and first-touch attribution (first source, first campaign) becomes available.

This mode stores an identifier on the visitor's device and requires consent in the EU. Wire it into your existing consent flow — a common pattern is calling identify() only after login, where your terms of service already cover it.

Beyond the browser: connecting your backend

The script sees what happens in the browser. For everything else, combine it with the Events API:

Browser-visible actions → FlowMyna.capture('Step Name', {...}) in your frontend. Joins the current session automatically.
Backend truths (payment confirmed, subscription changed, order shipped) → send from your server with your secret fm_live_ API key. Never put the secret key in browser code — the tracker ID is the only credential that belongs in a page.
Joining the two: call identify() when you know the user, and reference the same { "type": "User", "id": "user-123" } (or your own objects — Order, Subscription) in your server-side events. The web journey and your business process become one connected graph.
To attach a server-side event inside the current web session's case, forward FlowMyna.getSessionId() to your backend and include { "type": "Session", "id": "<that id>" } in the event's objects.

Limits and good citizenship

Batches are capped at 100 events; event properties at 30 keys / 500 characters each.
Each tracker key has an event budget over a rolling 30-day window; events beyond it are dropped (the response says so in an x-fm-dropped header).
Known bots and automated browsers are filtered server-side.
Query strings are stripped from captured URLs (UTM parameters excepted), and email addresses appearing in captured text are masked before leaving the page.