Script options

Every attribute the snippet accepts: test mode, debug logging, and the privacy signals.

Attributes

Every option rides on the script tag itself. A missing attribute means the server decides; false and 0 are the only falsey values.

Attribute	Effect
`data-debug`	Logs transport failures to the browser console. Useful while installing, off in production.
`data-respect-gpc`	Honour Global Privacy Control. On by default.
`data-respect-dnt`	Honour Do Not Track, in any of its spellings. On by default.
`data-require-consent`	Collect nothing until your consent banner calls oa.consent('granted'). Off by default, because measurement here is aggregate and first-party.
`data-storage="none"`	Strict mode: the script neither writes to nor reads from localStorage and sessionStorage. The per-tab session hint, the offline queue and the consent state then last one page load, and #oa-ignore does not work.

One attribute is weaker than it looks, on purpose: data-respect-gpc="false" cannot make GPC visitors countable. Our servers discard any request carrying the Sec-GPC header regardless of the snippet, so the attribute only controls whether the browser bothers sending. The DNT attribute works as written; GPC is the signal with legal force, and it is enforced on both ends.

Example: staging install

Create a separate site for staging and use its own tracking key, so staging traffic never mixes into production charts. (An older data-test-mode attribute is retired and ignored: traffic from snippets still carrying it is ordinary, visible and billable.)

<head> on staging

<script
  async
  src="https://c.analytics.carthagos.com/oa.js"
  data-key="YOUR_STAGING_SITE_KEY"
  data-collector="https://c.analytics.carthagos.com"
  data-debug="true"
></script>

What the script does on its own

With no options at all, the tracker records pageviews (including client-side route changes), engagement time (visible time, and active time near a real interaction), Core Web Vitals, and the events you mark up. Pageviews send immediately; everything else batches for about a second and leaves via sendBeacon when a tab closes, so nothing is lost to navigation.

Site-level behaviour (heartbeat cadence, redacted query keys, no-code rules, sampling) comes from your site's configuration and updates without touching the snippet.

What it never does

No cookies, no identifier stored on the device, no fingerprinting, no keystrokes, no form values, no session replay. The full list, with the reasons, is on the privacy and consent page.