What's new

You can now send pageviews and custom events directly from your backend using an authenticated HTTP API, without a browser or JavaScript snippet. The two new endpoints are: POST /api/v1/collect/pageview POST /api/v1/collect/event Both accept a tracking_id, url, and pathname. The pageview endpoint also accepts referrer, UTM parameters, and an optional timestamp for backfilling historical records. The event endpoint accepts a name, a props object for custom metadata, and the same optional timestamp. You can pass the visitor's IP address and User-Agent string to preserve geo data and device breakdowns. These fields are used only in memory to resolve a country and city and to compute the anonymous visitor hash. They are never written to any database table, log file, or storage system. The same anonymisation pipeline used by the JavaScript snippet applies here: The visitor hash is SHA-256(ip + user_agent + site_id + date). It rotates every 24 hours, making cross-day re-identification cryptographically infeasible. URL query strings and fragments are stripped from both the url and referrer fields before storage, so sensitive parameters in your URLs are never recorded. No cookies are set. No persistent identifiers are created. No consent banner is required. Authentication uses an API token with the new collect:write ability. You can create one from Settings, API Tokens. Server-side tracking is available on the Business plan and above. Common uses include tracking SSR pages in Next.js, Nuxt, or Laravel Blade applications; recording API route hits; firing conversion events from payment webhook handlers; and backfilling data from another analytics platform using the timestamp field.

GhostlyX now has a light mode. Click the sun/moon icon in the top right of any dashboard page to toggle between dark and light. Your preference is saved and applied instantly on every page, including settings, support, and TV mode. The theme system is built on CSS custom properties. Every colour in the dashboard is driven by a token that swaps when you switch modes, so there are no flashes of unstyled content and no full page reloads. The correct theme is applied before the first paint. A few things that adapt along with the colours: The traffic map tile layer switches between CartoDB Dark Matter in dark mode and CARTO Voyager in light mode, so the map always feels intentional rather than pasted in. Upgrade overlays on locked features use a frosted gradient that works in both modes, showing enough of the content behind to give you a sense of what you are missing without obscuring it entirely. The GhostlyX logo inverts automatically so it remains legible on a light background. The app is also now available at /app instead of /dashboard. The old URL redirects permanently, so any existing bookmarks or saved links will continue to work.

You can now transfer ownership of a site to another GhostlyX account directly from your dashboard. If you manage a site on behalf of a client, or need to hand off a project to a colleague, you no longer need to delete and recreate it. The new site transfer feature lets you send a transfer request to any email address. The recipient receives an email with a link to accept the transfer. Once accepted, full ownership of the site moves to their account, including all analytics data, goals, funnels, uptime monitors, heatmaps, shared links, annotations, and team members. To initiate a transfer, go to Settings > Team and scroll to the "Transfer site ownership" section. Select the site you want to transfer, enter the recipient's email address, and click "Send transfer". The recipient has 7 days to accept before the request expires. You can cancel a pending transfer at any time from the same page. Several safety checks are built in to prevent mistakes. You cannot transfer a site to yourself. Only one pending transfer per site is allowed at a time. The recipient's plan must have capacity for an additional site, and they cannot already own a site with the same domain. If the recipient was previously a team member on the site, their membership record is automatically cleaned up when they become the owner. Both parties are kept informed throughout the process. The recipient gets an email with the transfer details and an accept button. Once the transfer is complete, the original owner receives a confirmation notification. Site transfers are available on the Pro plan and above.

You can now run A/B tests directly from your GhostlyX dashboard, with no cookies, no flicker, and full privacy compliance. The new A/B Testing engine lets you create experiments that split traffic between variants using deterministic hashing. Each visitor is assigned a consistent variant based on a privacy-safe hash of their anonymised identifier and the experiment name. No personal data is stored, and no cookies are set. You can define conversion goals based on page visits, click events, or custom JavaScript events. Results are evaluated using Bayesian statistical analysis, which calculates the probability that one variant outperforms another. This means you get actionable confidence levels without waiting for arbitrary sample sizes. To enable experiments on your site, add the data-experiments="true" attribute to your GhostlyX tracking script tag. The experiment configuration is fetched automatically and variants are applied before the page renders, so your visitors never see content flicker. A/B Testing is available on the Business plan (up to 10 active experiments with 4 variants each) and the Scale plan (unlimited experiments and variants). If you are on a different plan, you can upgrade from your account settings. No changes are needed for existing tracking setups. If you do not enable the data-experiments attribute, your tracking script continues to work exactly as before.

You can now watch real visitor sessions replayed in your GhostlyX dashboard, with every interaction visible and zero personal data collected or stored. Session Replay records DOM snapshots, mouse movements, clicks, scroll positions, and page navigations. The recording is reconstructed as a video-style playback in your dashboard, complete with a timeline, event markers, and playback speed controls. You can see exactly where visitors click, how far they scroll, and where they get stuck. How we protect privacy at every layer: All text is masked before it leaves the browser. Every text node on the page is replaced with bullet characters client-side, before any data is transmitted to our servers. Names, email addresses, phone numbers, form inputs, and any other readable content are never captured. The raw text simply does not exist in the recording. Elements marked with data-gx-exclude are omitted from the DOM snapshot entirely. If you want specific non-sensitive elements like navigation labels or button text to remain readable, you can opt them in with the data-gx-visible attribute. No IP addresses are stored. We never write a visitor's IP address to any database, log file, or storage system. The Partial IP address is held in memory only long enough to perform two operations: generating a daily-rotating SHA-256 hash (combined with the User-Agent, site ID, and today's date) and resolving a partial, country-level geolocation for internal verification. Once those two operations complete, the address is discarded. There is no mechanism to retrieve or reconstruct it after the fact. No cookies are set. No fingerprinting is performed. No persistent identifiers of any kind are created. The daily-rotating hash means that even the anonymous session identifier resets every 24 hours. There is no way to link a recording from one day to a recording from another. No personal data is stored on our servers. The recording files contain only structural DOM data (with masked text), anonymised mouse coordinates, click targets, scroll offsets, and navigation events. Nothing in the stored recording can identify a person. The dashboard lets you filter recordings by device type, country, entry page, and duration. You can also filter to find sessions with rage clicks, dead clicks, U-turns, or JavaScript errors, which helps you focus on the recordings that reveal real usability problems. To start recording, add data-replay="true" to your GhostlyX tracking script tag. No other changes are needed. The replay extension is lazy-loaded only when this attribute is present, so existing tracking setups are unaffected. Session Replay is available on the Scale plan with up to 10,000 recordings per month and 90 days of retention. Recordings are stored as compressed JSON and automatically pruned after the retention window.