Tracking

Site pixel

One tag, /freebuff-tag.v2.js, on every page. It captures the click id, measures visits from your ads, and records conversions. No key, no backend, nothing charged.

Install

Every page

<!-- Once, in <head>, on every page. Tag id: console → Events. -->
<script async src="https://freebuff.com/freebuff-tag.v2.js?t=YOUR_TAG_ID"></script>

If you call freebuff() inline

<!-- If you call freebuff() before the tag loads, keep the stub first. -->
<script>window.freebuff=window.freebuff||function(){(window.freebuff.q=window.freebuff.q||[]).push(arguments)}</script>
<script async src="https://freebuff.com/freebuff-tag.v2.js?t=YOUR_TAG_ID"></script>

The tag updates in place within an hour; events are only ever added. For bytes that never change, use the pinned build. The Events page also copies a complete prompt for your coding agent.

Goals without code

A goal rule, set on the Events page, counts something the pixel already sees as a conversion for one campaign.

Kind	Matches	Example
`analytics_event`	An event name as your analytics tool sends it	`sign_up`, `purchase`, `CompleteRegistration`
`url`	A page path; * is one segment	`/welcome`, `/thanks/*`

Goals: Signup, Trial started, Demo booked, Installed, Paid subscription.
Up to 5 active rules per campaign. To change one, turn it off and add another.
Refused on a rate-card campaign, or one whose server postback reported the goal in the last 30 days.

Goals in code

freebuff()

// A conversion, in the success callback. value and plan are reported, never charged.
freebuff('conversion', 'subscription_started', {
  eventId: 'subscription_started:' + order.id,
  value: 49, currency: 'USD', plan: 'team_monthly',
})

// Any funnel step. Activity, not a conversion.
freebuff('track', 'pricing_calculator_used', { seats: 12 })

Names: signup_completed, trial_started, demo_booked, installation_completed, subscription_started, or your own snake_case.
eventId: your stable id, namespaced. Without one, repeats on the same click collapse to one.
Fire on success, not on a click. Do not double-report what your server reports.

Verify

Deploy. Events shows the domains the tag was seen on.
Verify → test click → do the real action. Watch for the Test event.
Debug on your own site
Add ?freebuff_debug=1 to any page, or run freebuff('debug') in the console. Logs locally, sends nothing extra.

Every visitor, under a random first-party id; a visit after an ad click also carries the click id. Text is scrubbed of emails, phones, keys and tokens before it leaves the page. The console's data level bounds all of it:

Level	Adds
Conversions only	Whether the tag is installed on your site (a count per site, no visitor data); Conversions your rules or code report
Standard	Pages viewed, time on page and scroll depth; Form progress: started, submitted or abandoned, with field names but never what was typed; Video watching, downloads and chat-widget opens; Events you send yourself with freebuff('track', …); Page speed and the visitor’s cookie-consent choice
Full	Button and link text, and links out to other sites; Code copied from code blocks (other copies record only their length); Site searches, error messages, and rage and dead clicks

Recorded and never recorded, by area

Area	Recorded	Never
Pages	Origin, path (ids become :id), title, referrer origin	URL fragment, full referrer
Query	utm_*, ref, source, search terms, keys you allow	Everything else (tokens live there)
Engagement	Visible and active time, scroll depth, visit number	Recordings, snapshots
Analytics	Event names you send to GA4, GTM, Segment, PostHog, Meta, Reddit, TikTok, with value and plan	Other properties, identify and alias calls, user traits
Clicks	Button and link text, outbound targets, rage and dead clicks	id and data-* attributes
Copy and search	Code copied from code blocks, site searches	Other copied text (length only)
Forms	Start, submit, abandon; field names	Values, keystrokes, passwords
Journey	Video play and watch %, download names, chat opens	Chat text
Health	TTFB, load, LCP, error messages	Stack traces
Device	Viewport, language, time zone, automation flag; country and UA added server-side	IP, other cookies, any email, phone or user id

Delivery and retries

Sends with fetch + keepalive, no cookies. Failed sends retry at 2, 10, 30, 60 and 120 s, up to five times within 24 hours, including on the next page load. Each batch has an id, so a resend never counts twice. Automated browsers are received but never count as landed or engaged.

Consent

Reads IAB TCF, Google Consent Mode, OneTrust, Cookiebot. On a denial, or Global Privacy Control, it records nothing and drops its visitor id; it resumes on consent.
In the EEA, UK and Switzerland, load it only after consent.
Cookies bfvid, bfcid, bfvis; local storage bfq, bfql for retries.

Text for your cookie notice

The Freebuff pixel measures every visit to this site and sets three first-party cookies: bfvid (a random visitor identifier, renewed for up to a year), bfcid (the Freebuff ad click identifier, up to 30 days, only after a Freebuff ad click) and bfvis (a visit counter with no identifier). When a send fails, it keeps the unsent measurement events in local storage (bfq, with a short-lived bfql lock between tabs) for up to 24 hours so it can resend them, and removes them once delivered. When consent is denied or the browser sends Global Privacy Control, it records nothing about the visit, deletes bfvid, writes nothing to local storage and clears what it kept.

Domains, GTM, CSP

Subdomains share the click id (widest domain, last click wins). For a different domain, add it under linked domains (up to 10) and install the pixel there too.
Google Tag Manager: the Freebuff Pixel template, or import /freebuff-tag.v2.gtm.tpl. Fire on All Pages.

Pinned build (never changes)

<script async src="https://freebuff.com/freebuff-tag/v2/ab6607d7e54f3501.js?t=YOUR_TAG_ID" integrity="sha384-RdCDlqAOAfMXKQCCv+9WCKhFNb08sdloLyXyDxQJzQXIWpWgrTtmfWZXjolZ1gsa" crossorigin="anonymous"></script>

Content-Security-Policy

script-src https://freebuff.com
connect-src https://freebuff.com