Repository navigation
Record where new accounts first came from - #337
Merged
Merged
Conversation
The site and /sign-up keep a visitor's first touch in localStorage (path, referrer host, campaign parameters), onboarding reports it once and /admin/signups shows the counts. No third-party script and no cookie; nothing is stored with Global Privacy Control on.
github-merge-queue
Bot
removed this pull request from the merge queue due to a conflict with the base branch
Nov 5, 2026
pumfleet
enabled auto-merge
November 5, 2026 18:25
# Conflicts: # apps/web/AGENTS.md # packages/db/migrations/meta/0140_snapshot.json # packages/db/migrations/meta/_journal.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
We can't tell whether search brings anyone who signs up, so we can't tell whether any SEO work pays off. This records where each new account first came from, with no third-party script and no cookie. Legal confirmed no policy changes are needed.
How it works
/sign-upremember the first visit inlocalStorage(@coss/auth/first-touch). The two apps share coss.com's origin, so the dashboard can read what the site wrote. A later visit doesn't overwrite it until it's 90 days old./onboardingreports it once through a server action, then forgets it. This covers email and social sign-ups alike. The server validates it again and only accepts it for the signed-in user, within 7 days of the account being created, and never while impersonating./admin/signupsshows the counts for the last 30 days: first page, referrer and campaign source.What's stored
The first page's path, the referrer's host,
utm_source(orref),utm_medium,utm_campaignand a timestamp. Never full URLs or query strings. With Global Privacy Control on, nothing is stored.signup_attributionis keyed by user and cascades when the account is deleted.What it misses
/ui,/originor/qnot, which are separate apps. If they then reach a site page, it's recorded as that page with no referrer.The admin card shows how many accounts have a record, so these gaps stay visible.
Testing
Run against a throwaway database (
coss_seo_test), with both apps on spare ports:packages/authand DB tests inpackages/tenancypass (including the cascade), as do the fullpackages/tenancyandapps/websuites.utm_source, reaches onboarding, and checks the row is written and the browser value is gone./compare/resend?utm_source=hn&token=secretwith a Google referrer stored only the path, host and source; a second page didn't overwrite it; no cookies were set; Global Privacy Control stored nothing.biome ci .and typecheck for web, site, tenancy, auth and db pass.Not checked: the admin card in a browser, and a real social sign-up.
After merge
The migration (
signup_attribution) needs to run. I'd check the admin card after the first few sign-ups.Open in [code]smith · Need help on this PR? Tag
@codesmith-botwith what you need.