policy.did.bot now sends pageviews to PostHog (EU project 338005), only when served from that exact hostname. posthog-js's slim build is bundled from the lockfile with external loading off, so the page still runs no script from another origin and the CSP is unchanged: connect-src https: already covers PostHog.
Every event loses URL queries and fragments (where an OAuth callback carries its code), record keys in paths, and DIDs. main, the tray and the account corner carry ph-no-capture. The cookie is host-only. Session replay is off.
A footer holds the placeholder ⟦MARROWGLADE⟧ for an analytics notice.
🤖 Generated with Claude Code