Web ve mobil ziyaretçi analitiği

Webtracking is a multi-tenant, real-time visitor analytics platform for websites and mobile apps that I built for Makdos. It measures what visitors do on a site, shows what is not working, and tries to prove whether a fix actually made a difference. The platform covers tracking, reporting, experimentation and recommendations end to end, while operational work such as procurement, shipping or stock is deliberately left out of scope.

Purpose

Many sites today collect incomplete analytics data. Ad blockers stop tracking scripts loaded from third-party domains, a visitor who leaves a tab open appears to stay on the site for hours, and a customer returning from a payment page is counted as a new traffic source. When these errors reach the reports, advertising budgets end up being spent on the wrong channels.

I built this platform to make the measurement itself reliable and to show clearly which method and which assumption every report is based on. My goal was to let customers handle most of their advertising, audience and conversion work from this panel without having to go into the Google and Meta dashboards.

How it works

Data collection works as first-party tracking. A subdomain of each customer site's own domain is pointed to the platform, so the tracking script and the data it sends are served from the customer's own domain and are not caught by ad blockers' third-party lists. Each site uses its own certificate and its own tracking code. Request paths carry neutral names, and every site has its own path salt that can be rotated from the panel.

The collected data includes page views, clicks, scrolling, mouse movement, form interactions, page speed measurements known as Core Web Vitals, JavaScript errors and commerce events. To avoid slowing down the visitor's page, I chose to take snapshots of the page instead of continuous screen recording. I measure time as active time rather than wall-clock time, which means time only accumulates while the page is visible, the window has focus and there has been interaction in the last few minutes.

Two separate processes run on the server. The collector process validates incoming events and hands them to a bounded write queue that never blocks. When the queue is full, dropped events are counted and logged. The live stream is published before the data is written to the database, so the real-time screen does not freeze when the database slows down. The API process serves the panel, the reports and the external integrations.

Each reseller's data is kept in a separate physical database, and these databases can be placed on different servers when needed. Control data such as resellers, quotas and users lives in a separate, small master database.

Key features

• The panel consists of thirteen task-oriented menu categories, and a four-question setup wizard decides which pages appear in the menu based on the customer's goals.
• On the reporting side, more than eighty reports are produced from a single table structure, and the same data can be downloaded as JSON, CSV, Excel and PDF.
• Attribution models include last touch, first touch, linear, position-based and time-decay models, and multi-touch models distribute a sale across channels while preserving the total.
• The opportunity analysis states the method and confidence level on every row, so a measured value is kept apart from an estimate based on assumptions.
• Analyses such as RFM segmentation, customer lifetime value, cohorts, funnels and anomaly detection are available out of the box.
• The heatmap and session replay show clicks, scrolling and mouse movement on top of a real snapshot of the page.
• The A/B testing engine calculates variant assignment instead of storing it, never declares a winner before the minimum sample size is reached, and does not inject code into the page.
• Events are forwarded from the server to Google Analytics 4 and the Meta Conversions API, and double counting is prevented when browser and server paths are used together.
• The Audience Hub shares marketing segments with Google Ads, GA4 and Meta audiences using only SHA-256 hashes, and only people with marketing consent are added to an audience.
• The Ads Hub shows Google Ads and Meta spend, puts the sales measured by the platform next to the sales the panel itself attributes to the ads, and offers recommendations ranked by impact and confidence; no recommendation is ever applied to a platform automatically.
• Marketing automation runs email, SMS, WhatsApp and push notification channels through the same consent, frequency and quiet-hours rules.
• In gamification tools such as spin-the-wheel and scratch cards, the result is decided on the server and prizes are delivered by coupon, webhook or API.

Mobile app and AI connection

The platform is not limited to websites. iOS and Android apps can be registered in the panel and linked to a site, and app data lands in the same reports broken down by platform and version. Push campaigns can be sent through Firebase and Apple's notification service, and they only go to devices with permission and marketing consent. In addition, there is a read-only mobile app I wrote with React Native that lets customers follow their sites' traffic from their phones.

I also added an MCP server to the platform. MCP is a protocol that lets AI assistants connect to external systems as tools. This server is completely read-only, works with the customer's API key and scopes, and always returns personal data in masked form.

Security and privacy

• A persistent visitor identifier is only created when analytics consent is given; if a visitor rejects everything, their identifiers are deleted and only the choice itself is kept.
• If a site already has a cookie consent tool, the decision the visitor made in that tool can be read and used as the platform's consent.
• The deletion flow removes behavioural data and anonymises consent records, which serve as legal evidence.
• Consent records, visit logs and audit records are archived periodically and can be stamped with a Kamu SM timestamp, the Turkish public certification authority's trusted timestamp service.
• Two-factor authentication is available for both the panel and the admin login; tenant secrets are encrypted with Fernet and panel passwords are stored with argon2id.

Technical stack

• I wrote the server side in Go, using chi, pgx, slog and goose.
• I use PostgreSQL with the TimescaleDB extension as the event store and open a separate database for each customer.
• Tenant connections go through PgBouncer, so the database connection limit is not exhausted as the number of resellers grows.
• For the real-time screens I use publish-subscribe and sorted sets on Valkey.
• The tracking script is written in framework-free JavaScript, minified with esbuild and embedded in the Go program.
• The customer panel and the admin panel are single-page applications written in framework-free JavaScript.
• All services run directly on the server under systemd, behind nginx with HTTP/3 support.

Use cases

• E-commerce sites that want to recover conversions lost to ad blockers can use this platform.
• It suits marketing teams that want to compare the real sales impact of Google and Meta ads with their own measurement.
• Brands with both a website and a mobile app can see data from both channels in the same reports.
• Agencies and resellers that want to offer analytics services can manage their own customers through the quota-based reseller model.