Fruitalytics

Fruitalytics is first-party product analytics for BYOB-generated apps and standalone websites. It gives each site a write key for event collection and a read token for dashboards and API access.

Register a website

Agents and humans can register a website without the admin token by calling:

POST /v1/register
Content-Type: application/json

{
  "name": "Example Product",
  "origins": ["https://example.byob.page"]
}

The response includes one-time install credentials:

site_id=site_...
write_key=pk_...
read_token=rt_...
auto_pageviews=true
auto_routes=true
autocapture=true
capture_errors=true
capture_network_errors=true
capture_performance=true
capture_scroll_depth=true
capture_outbound_links=true
capture_downloads=true
capture_rage_clicks=true
capture_impressions=true
script_src=https://.../analytics.js
hashed_script_src=https://.../analytics/analytics.<hash>.min.js
tracking_code=<script ...></script>
dashboard_url=https://.../dashboard?site_id=site_...&token=rt_...

Use tracking_code directly when installing Fruitalytics on the registered website.

Allowed websites

Self-registration and browser event ingestion are currently allowed only for:

• subdomains under byob.studio
• subdomains under byob.page
• localhost
• 127.0.0.1
• ::1

Custom domains can be admitted later through the service-side allowlist.

Install tracking

Add the returned script tag before </body>:

<script
  async
  src="https://fruitalytics.example/analytics.js"
  data-site-id="site_..."
  data-write-key="pk_..."
  data-auto-pageviews="true"
  data-auto-routes="true"
  data-autocapture="true"
  data-capture-errors="true"
  data-capture-network-errors="true"
  data-capture-performance="true"
  data-capture-scroll-depth="true"
  data-capture-outbound-links="true"
  data-capture-downloads="true"
  data-capture-rage-clicks="true"
  data-capture-impressions="true"></script>

Generated tracking code records page_view on initial load, client-side route changes, clicks, form submissions, input/select/textarea changes, JavaScript errors, unhandled rejections, failed API calls, performance metrics, scroll depth, outbound/download clicks, rage clicks, and annotated impressions by default. Use data-auto-pageviews="false", data-auto-routes="false", data-autocapture="false", or the relevant data-capture-*="false" only when a site explicitly wants to opt out.

The write key can send events. It cannot read dashboards or create sites.

Track events

Custom JavaScript events:

window.fruitloop.track("cta_clicked", { location: "hero" });
window.fruitloop.page({ source: "manual" });
window.fruitloop.identify("user_123", { plan: "pro" });
window.fruitloop.flagEvaluated("new_checkout", "variant_a");
window.fruitloop.variantSeen("pricing_test", "b");
window.fruitloop.surveyResponse("nps_q1", { rating: 9 });
window.fruitloop.flush();

Annotated HTML events:

<button data-fl-event="cta_clicked" data-fl-location="hero">
  Start
</button>

Broad autocapture is enabled by default:

<script
  async
  src="https://fruitalytics.example/analytics.js"
  data-site-id="site_..."
  data-write-key="pk_..."
  data-autocapture="true"
  data-auto-pageviews="true"></script>

Autocapture records clicks, form submissions, and input/select/textarea changes as $autocapture events. It does not collect input values.

Diagnostics and engagement events avoid request bodies and form values. URLs are stored without query strings or hashes.

Annotated impressions:

<section data-fl-impression="pricing" data-fl-plan="pro">
  ...
</section>

Read analytics

Open the returned dashboard_url, or call:

GET /v1/dashboard?site_id=<site_id>&limit=50
Authorization: Bearer <read_token>

The read token can read analytics for its site. It cannot send events or create sites.

Protection

Fruitalytics applies origin checks, self-registration rate limits, and failed-token throttling. Browser events must come from an origin that is both registered to the site and allowed by the service-wide host policy.