Replace PostHog with self-hosted Umami analytics

[Melvynx]

What changed

• load the self-hosted Umami tracker once from https://analytics.melvynx.dev/script.js
• restrict automatic page-view tracking to the production saveit.now hostname and respect Do Not Track
• remove the PostHog SDK, provider, error boundary, event calls, build variables, and Dokploy PostHog environment keys
• add a typed, dependency-free Umami event helper that safely no-ops during SSR or when the tracker is unavailable
• track only SaveIt-relevant aggregate actions without bookmark IDs, URLs, email addresses, or other user content
• update analytics documentation and the privacy disclosure

SaveIt events

• bookmark opened, copied, shared, deleted, and reprocessed (with UI surface only)
• bookmark import count and CSV export
• social sign-in started (provider only)
• upgrade checkout started (monthly/yearly only)
• iOS download clicked (UI surface only)

Validation

• pnpm --filter web typecheck
• pnpm lint (0 errors; existing repository warnings only)
• pnpm --filter web test:ci (183 tests passed)
• production pnpm vercel-build
• generated output contains the expected Umami endpoint and zero PostHog references
• https://analytics.melvynx.dev and /api/heartbeat return HTTP 200 with valid Let's Encrypt TLS
• Umami collector accepted a synthetic verification event and created a session and visit

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
saveit-now-web	Ready	Preview, Comment	Jul 10, 2026 4:13pm

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 50471ae69b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Strip sensitive query strings from Umami pageviews

With the global Umami script enabled here, automatic pageviews will include the page URL's search string unless it is explicitly excluded; this app has real secrets/PII in query params, e.g. /auth/mobile-login?token=..., /unsubscribe/$userId?token=..., and /signin?email=.... When those links are opened on saveit.now, the tokens/emails get sent to analytics, so add data-exclude-search="true" or a data-before-send scrubber before enabling the tracker globally.

Useful? React with 👍 / 👎.