Changelog What shipped

Every site now has a compliance configuration the collector reads on each hit. Set the default collection tier, whether consent is required, and how many IP bytes to truncate before the city lookup. Regional rules for the EEA, UK, California, the rest of the US and China can override each field; a blank field inherits the project default.

Data-subject requests — access, erasure, restrict and portability — are filed from the same screen, run after a cooling-off period and leave an audit trail. Two presets apply a whole policy in one step and lock the fields they set.

Data export now accepts a range of up to 12 months per job and adds consent_log to the kinds you can export. Finished files are gzip JSONL and stay downloadable for 48 hours. Pro allows 3 jobs a day; VIP tiers have no daily cap.

Retention is now clamped to your analytics plan — 6 months on Free, 12 on Pro, 24 or more on VIP — and when a paid period ends, older rows become read-only for 30 days instead of disappearing on the day of expiry.

Frameworks that route with #/path changed the URL without a pushState, so the script saw one pageview for the whole visit. Add data-hash="true" to the script tag and every hash change is a pageview with the right path and title.

The same release fixes duplicate pageviews when a page included the snippet twice: only the first copy runs now, and the console shows a warning on the SDK code page.

Chat no longer needs a website. Every site gets a full-screen chat page at app.tapcub.com/c/{siteKey} that you can put behind a QR code, in an email signature or on a social profile. Visitors inside the on-site bubble can also choose Open in a new window and continue the same conversation there.

The Install page also gained a test page that simulates a real visitor with your site key — bubble, message, inbox, reply — so you can train agents without touching the live site.

The AI analyst turns a question such as “which channel brought the most sign-ups last week” into a query first, and only asks a model to polish when the rules are unsure. Answers show the query that produced them, so nothing is a black box.

The same capability is exposed read-only over MCP: list projects, run saved analyses, ask in plain language and summarize a dashboard from Claude, Cursor or any MCP client. Nothing is written back.

The iOS, Android, HarmonyOS, Flutter and React Native SDKs queue events while offline and send them in order when the network returns, with the original timestamps. App reports now break down new, active, retention and crashes by version and distribution channel.

WeChat, Alipay and Douyin mini-program SDKs gained scene-value grouping and share-chain tracking, and reuse the app report pages so one person is one row across web, app and mini-program once identified.

With two-way automatic translation on, a visitor’s message appears in the inbox as the original plus a translation into the agent’s language, and the agent’s reply is translated back before the visitor sees it. Eighteen languages are supported, including Simplified and Traditional Chinese, English, Japanese, Korean, German, French, Spanish and Arabic.

Translation runs inside a 3-second budget; if it fails, the original is still delivered and the inbox says so. Translation and AI replies share the monthly AI-call budget, and an exact knowledge-base match costs nothing.

An industry pack for e-commerce, SaaS, content and media, education, finance, games, lead generation, healthcare, real estate or automotive installs the event definitions, metrics, goals, funnels, a journey and dashboards that business normally needs. Existing names are reused, and nothing in the pack creates data — it only gives your data a shape.

Each pack is documented on its own solution page, with cross-border trade as an eleventh page that reuses the e-commerce pack.

Any row in the Bots report now has Report false positive. A reviewer checks the signature and the fix applies to every site, so a monitoring tool or a company proxy misread as a crawler is corrected once.

The search-engine health table counted a fetch that returned 404 both as a fetch and as an error, which inflated the error rate. Fetch counts, success rate, 404s and 5xx are now independent columns.

Autocapture records clicks, form submits and link taps before anyone writes a track() call. Overnight, the inbox clusters them by element and page and suggests a name from a rule or a model. You accept, merge into an existing event or ignore; accepting backfills the last 90 days so funnels have history on day one.

The inbox also lists unplanned events — names your code already sends with no definition — so the event picker stays clean. Available from Pro.

The Sources report reads the click ID that ad platforms append to landing URLs: Google Ads, Meta, TikTok, Microsoft Ads, X Ads, LinkedIn, Snapchat, Pinterest, Reddit Ads and Yandex Direct, plus Ocean Engine, Baidu Marketing, Tencent Ads and Kuaishou in China. A visit with gclid, msclkid or bd_vid is classified as paid search even without UTM.

The raw ID is hashed before storage and shown only as a type, and clicking a row filters every other report by that platform. Channel ROI now sits beside goal conversions in Marketing analytics.

An invite rule now takes a URL pattern and a delay instead of applying to the whole site, so you can wait 40 seconds on the pricing page and never interrupt a blog reader. The teaser card above the bubble, the timed invite and an agent’s manual opening line to a live visitor are three separate settings with their own copy.

Rules are capped by plan: 1 on Free, 10 on Pro, unlimited on VIP 1 and 50 on VIP 2.

Every hit is checked against user agent, request headers, client signals, network ASN and request frequency before it is stored. Recognized bots go to their own report and stay out of visitors, sessions and pageviews — and out of your monthly quota. The rule set is maintained centrally and currently holds 197+ rules.

The new AI ledger lists, per operator, how many pages were fetched for training and for answer engines, how many human visitors that operator sent back, and the ratio between the two. Crawl health compares your robots.txt and llms.txt with what crawlers actually fetched.

Watch any built-in measure or saved metric with a threshold, a period-over-period change, a forecast band or an anomaly check. Hits go to the project’s notification channels — email, Slack, Telegram, WhatsApp or a webhook — with a link to the report filtered to the moment it happened.

Scheduled reports send a daily, weekly or monthly digest at an hour in the site time zone: core metrics, rising pages and sources, and goal conversions. Monitors and reports are included from Pro.

The core script now carries only pageviews, sessions and custom events. Identity, autocapture, consent handling, error capture and the chat launcher are separate modules that load from the same origin only when the project needs them. The script is asynchronous, writes no cookie by default and never blocks rendering.

The collector keeps answering 202 for stored and dropped hits alike, so verify installs in Realtime rather than by status code — the install guide was rewritten around that check.