Make Umami tracking work in privacy browsers

[Melvynx]

What changed

• remove the Umami data-do-not-track opt-out that suppressed visits from privacy browsers
• serve the Umami tracker through /api/insights/script on saveit.now
• relay events through the first-party /api/insights/api/send endpoint
• forward only the headers Umami needs, cap event payloads at 64 KiB, and disable response caching for events
• keep tracking restricted to the production saveit.now hostname and retain cookieless, privacy-minimized analytics

Root cause

Helium is privacy-focused and blocks third-party trackers by default. SaveIt also explicitly told Umami to honor Do Not Track, so Helium could suppress the tracker before any page-view request reached Umami.

The Umami service, PostgreSQL database, TLS, and collector were healthy. A standard page-view request was accepted and stored successfully.

Validation

• pnpm --filter web typecheck
• pnpm --filter web test:ci (183 tests passed)
• local first-party script endpoint returns HTTP 200 and valid JavaScript
• local first-party event endpoint returns HTTP 200 and creates an Umami visit
• unknown proxy paths return HTTP 404
• rendered HTML uses the first-party endpoint and no longer enables DNT suppression

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
saveit-now-web	Ready	Preview, Comment	Jul 14, 2026 6:18am