Agent-readable docs index: /docs/llms.txt. Full docs in one file: /docs/llms-full.txt. Download /docs/docs.zip to grep all markdown files locally.

Privacy-First Analytics & Realtime Aggregation

Modern data privacy regulations — GDPR, CCPA, and the ePrivacy Directive — require businesses to treat user tracking with care. Many legacy analytics platforms rely on persistent tracking cookies, canvas fingerprinting, or storing raw IP address logs.
Shaf was engineered to be privacy-first by default — delivering rich click insights without compromising visitor privacy.

What We Don't Collect

No Cookies
Shaf short links never set persistent tracking cookies on visitor browsers. There is no session cookie, no tracking pixel cookie, and no cross-site identifier.
No Fingerprinting
No canvas fingerprinting, WebGL fingerprinting, font enumeration, or behavioral fingerprinting techniques are used to track or identify individual visitors.
No Raw IP Storage
IP addresses are processed ephemerally at the edge to extract coarse geographic metadata only. The raw IP address is discarded immediately and is never written to disk or database logs.

What We Do Collect (and How)

When a visitor clicks a short link, Shaf records the following anonymized, aggregate-safe telemetry:
Data PointResolutionMethod
CountryCountry code (e.g. US, DE)Cloudflare GeoIP header
CityApproximate metro cityCloudflare GeoIP header
Device CategoryMobile, Desktop, TabletUser-Agent parsing
Browser EngineChrome, Safari, Firefox, OtherUser-Agent parsing
Referrer DomainDomain only (e.g. t.co, linkedin.com)Referer header, stripped to domain
Click CountInteger counter per eventCloudflare Analytics Engine
No visitor name, email, or persistent identifier is recorded. Each click is an anonymous, aggregated data point.

Analytics Engine Architecture

Instead of traditional relational SQL tables that degrade under high write loads, Shaf uses Cloudflare Analytics Engine — a columnar time-series system powered by ClickHouse at the edge:
Rendering diagram...
The analytics write happens off the critical request path via ctx.waitUntil() — the redirect fires first, then the telemetry is committed in the background. This ensures tracking has zero impact on visitor redirect latency.

Pseudo-Live Realtime Replay

The Shaf dashboard shows a continuously updating stream of click events that feels live — but is actually a carefully engineered replay system designed to minimize resource consumption:
Rendering diagram...
MechanismDetail
Polling intervalAnalytics API is polled every 10 seconds
Queue replay rateEvents are dequeued at approximately 1 event/second for smooth animation
Pause behaviorPausing the dashboard stops polling, queue drain, and WebGL globe motion
Not a live streamThis is not a WebSocket or SSE stream — it is a client-side simulation for UX purposes
This approach provides an intuitive, real-time pulse visualization of marketing campaigns with minimal client battery, CPU, and data overhead.

GDPR & Compliance Considerations

Because Shaf does not collect PII or use tracking cookies:
  • No cookie consent banner is required for the short link redirect mechanism itself.
  • No data processing agreements are needed between Shaf and your organization for visitor analytics (analytics data is fully aggregated and anonymous).
  • Raw click data is never shared with third-party advertising platforms.
If your destination website uses cookies or tracking (e.g. Google Analytics on the landing page), consent requirements apply to that website separately from Shaf's redirect mechanism.