Every did.bot page except /api/ now loads posthog-js into the shared EU project "did.bot" (338005). It reports only on the exact hostname did.bot, so astro preview and copies of the site send nothing. It uses posthog-js's default persistence (cookie and localStorage) and person_profiles: "identified_only", so anonymous visitors get no person record.
deploy/site/csp.json now allows eu-assets.i.posthog.com in script-src and connect-src, and eu.i.posthog.com in connect-src. The site's build and tests pass. In headless Chrome under this CSP, events were sent with nothing blocked, and the old CSP blocked them.
The privacy page has a MARROWGLADE placeholder for the owner's copy.
🤖 Generated with Claude Code