Changelog

Added

• Export has moved to Settings, and the file is made from the full data. Settings → Site → Export replaces the download button on the dashboard chart. Choose a range (any of the usual views, All time, or your own days, always in your site's timezone), the tables you want and a format: Excel, one sheet per table; CSV, a zip with one file per table; or JSON. The file is built by Pulse's servers from everything stored, not from what the dashboard happened to have loaded.

  Every file says what it holds. A Notes sheet in Excel, a README.txt in the CSV zip and a notes object in JSON name the site, the range and its timezone, the filters, when the file was made, which days were imported from another tool, and where a change in how Pulse measures falls inside the range. The daily summary now carries visits beside visitors. A number Pulse did not measure is an empty cell, never a zero.

  Advanced options add the rest: 18 tables (pages, entry and exit pages, sources, channels, UTM source, medium and campaign, countries, regions, browsers, operating systems, devices, languages, goals, events and event properties), which metrics, the daily summary's time grain (hour, day, week or month), the dashboard's own filters, and how many rows per table, up to all of them. The daily summary reaches back to your site's first day; every other table covers up to a year at a time.

  Who can export is unchanged, and every export is recorded in your audit log as Exported data. Beside it, Your own tools points at API keys, the pulse command line and AI assistants through MCP.

• Growth reports: a designed report of your site to send to investors, clients or your board. In Settings → Site → Export, choose a period, what to compare it with and which slides to include: headline numbers, twelve months of growth, where visitors come from, what they read and where they are, devices and goals. Pulse makes it once and keeps it as it is, so a report sent in March still says what it said in March. You get a link to a page of slides, and a PDF of the same slides at 16:9 that drops straight into a deck, in a light or dark look you choose for that report. A link can have a password and an expiry, and deleting a report closes its link and deletes its numbers. The person you send it to sees that report only, never your dashboard.

• Scheduled report emails. Have a report made on the 1st of every month or quarter, covering the one that just ended, and emailed to the members of your team you choose. Each email links to its own report, which never changes afterwards. Anyone else gets the link from you.

  Reports and scheduled emails are listed under Your reports, and making, deleting, starting and stopping them is recorded in your audit log.

• All time — from a page's first day of data to its newest, worked out by the server for each page. Past a year the chart switches to weekly, then monthly points.

• Ask your AI assistant about your analytics: the Pulse Analytics MCP server. Claude, ChatGPT, Cursor, VS Code, Microsoft Copilot Studio and Mistral Le Chat can now read your Pulse numbers. Add https://pulse-api.ciphera.net/mcp to your assistant, sign in with your Ciphera account, and choose on a Pulse screen which workspace — and which of its sites — it may read. There is nothing to install.

  It can read, and nothing else. Seven tools: your sites, totals for a period, a daily series, a breakdown (pages, entry and exit pages, referrers, channels, countries, regions, browsers, operating systems, devices, languages, UTM source, medium and campaign), realtime visitors, your install snippet, and a search of the Pulse docs. No tool changes anything in Pulse.

  Text your visitors sent is marked as theirs. Page paths, referrers, campaign tags and languages come from visitors' browsers, so they reach the assistant cleaned of invisible characters and labelled as visitor-supplied data, never as instructions.

  You can take it back at any time. Settings → MCP lists every connected assistant, who connected it and when it was last used; Disconnect takes effect on its next request. Connecting needs the Owner or Admin role, and each person can connect up to 3 apps to a workspace — they do not count against your API keys. An API key also works, for scripts and clients without sign-in.

  Where the numbers go is your choice. An assistant receives the numbers it asks for; if it runs outside the EU, so do those numbers. Pulse itself never sends your data to an AI model. Read MCP privacy and security before you connect, and the setup guide for each assistant.

• The public read API has a breakdown route. GET /api/public/v1/sites/{id}/breakdown returns the top rows of one dimension — the same dimensions as above — for a period, with optional filters. It is additive, like every change to the public API, and it is what the assistant's breakdown tool calls.

• Choose how long a returning reader is recognised (retired 27-10-2026). Settings → Privacy had a Visitor identity panel: Session only, 24 hours, 7 days or 30 days. Until a site chose, it kept the calendar-month behaviour that ran from 26-08-2026 to 26-10-2026: a returning reader was recognised for the rest of the calendar month in the site's timezone, and the menu showed that as Calendar month (current). A visitor is now recognised for one day at most (see A visitor is recognised for one day, at most, under Changed). This entry is kept as history.

  A window was a ceiling, not a promise. A reader first seen near the end of a window was recognised for less than it, exactly as a reader first seen on the 30th was recognised for one day. Every sentence in the product said "up to".

  Session only changed what "visitors" meant on that site. No visitor identity was written at all, so a reader was counted once per day and never recognised on a later visit: the number became daily session counting, the way it was for every site before 26 August 2026. The dashboard's Unique visitors definition, the Visitors page and the privacy-policy snippet all said so on a site set that way, rather than asserting the month. The public read API's visitors field kept its name and its shape; on such a site it inherited the same meaning, and the day you changed the window was a measurement boundary for that site: identities before it could not be re-derived, so a range that crossed it counted a returning reader once on each side.

  Changing the window was deliberate and recorded. The panel said what the change cost before you saved it: every identity was re-minted from that moment, readers recognised under the old window counted as new people, and nothing could be applied backwards. Every change was written to your audit trail.

• Optional interaction capture: see what visitors did, not only which pages they saw. A second, optional script records the label of a button or link that was clicked, how much text was copied and which forms were submitted — and the visit trail describes them in place.

  It is not part of your tracking tag and does nothing until you add it. Settings → Site → General has a switch that writes the extra <script> line for you, with a separate switch for each of the three kinds.

  What it never records, by design and pinned by tests: anything you type, the text that was copied, any form field's value, any form field's name, and anything about where an element sat on the screen — no CSS selectors, no coordinates.

  What it strips before anything is sent, in the visitor's own browser: email addresses become [email], long digit runs become [number], and labels are cut to 60 characters. Add data-pulse-ignore to any element and nothing inside it is ever recorded, at any depth.

  The main script is unchanged and still under 3 KB gzipped — the new code is a separate file, so a site that does not want interaction capture pays nothing for it.

• A visitor's visits now read oldest to newest, and their steps group by page. The Visits list was the only thing on the visitor page running newest-first, while the month ribbon above it reads day 1 to 31 and the steps inside each visit read forwards in time — so you went down the steps forwards and up the visits backwards. Page 1 still holds the most recent visits; it just reads in the same direction as everything around it.

  Nothing was ever shown twice. Opening a visit used to print one row per event, and a custom event carries the page it fired on — so a page with two events on it appeared on three consecutive rows. Now a row is a page, with the events that fired while it was open listed beneath it. One real example went from 17 rows to 8, and the "—" that used to sit in the duration column of every event row is gone: an event has no duration to report, which is what the dash was saying nine times over.

  A page you genuinely visited twice still appears twice, because those are two separate pageviews.

• Filter a visit's steps by type. An expanded visit now carries small counters — Pages, Outbound, Downloads, Events — and clicking one hides or shows that kind. The counts describe everything loaded and do not change as you filter, so a counter you switched off can always be switched back on. The last active one cannot be switched off, because an empty list looks identical to a visit that recorded nothing.

• Outbound clicks and downloads are described in words. Instead of an event name beside a url chip beside a page_path chip repeating the row's own path, a step now reads "Left for stripe.com/pricing" or "Downloaded price-list.pdf".

  Your own custom events are unchanged, and deliberately so: only you know what checkout_step means, so Pulse shows its name and every property rather than guessing at a sentence. The distinction is drawn from the event's exact shape, not its name — one site sends an event called outbound_click that is about garments.

Fixed

• When the dashboard failed to load, the error replaced the whole page, including the date picker and the realtime toggle, so the only way to try another range was to edit the address. The toolbar now stays above the error, and Retry is unchanged.

• Uptime and Pages offered Last 1 hour and Last 24 hours over data kept by the day, and showed whole days under those labels. The rows are gone (#742).

• Journeys offered Today, which was always empty: journeys for a day are built after it ends. It is now greyed, and a remembered Today shows yesterday there.

• A custom range longer than a page can load was accepted by the calendar and then refused by the server. The calendar now stops at the page's limit, and a longer range carried over from another page is shortened to it, keeping its end date.

• Visitors listed Last 1 hour and Last 24 hours twice, and opened with its selected row out of sight below the fold.

• On CDN, a range reaching back more than a year would have failed the Served from card, because Bunny answers for a year at most. The card now shows the last 12 months of such a range and says "last 12 months".

• The line connecting the steps of a visit now runs through them. It sat 12 pixels to the left of the dots it was joining.

• Visitors — a per-visitor view of your own analytics, off by default. A new page under Analytics (G V) lists the readers seen in a range and drills into one of them: their visits, the pages of each visit in order, dwell per page, and any custom events they fired with their full properties. There is a live mode with rolling windows down to the last 30 minutes.

  This changes what Pulse will show you, not what Pulse collects. Every column the page reads was already being written for every site; the switch controls whether anyone can read it at visitor grain. It is off for every site, including existing ones, and turning it on is a deliberate act by a site owner that is recorded in your organisation's audit trail. Settings → Site → Privacy → Visitor views.

  What a "visitor" was here, exactly (26-08-2026 to 26-10-2026). A server-derived pseudonymous key, re-minted at the start of every calendar month in your site's timezone. It carried no name, no email, no account, no cookie and nothing stored on the reader's device, it could not be linked to the same person on another site, and at the end of the month it stopped existing: a returning reader came back as a new visitor, under a new name. The page said so on its face rather than in a footnote. History began 26 Aug 2026, the day monthly identity was introduced; the date picker did not offer earlier days, because earlier rows had no monthly key at all and showing them would have labelled per-day identities as if they were per-month ones. Since 27-10-2026 each profile covers one IP address and browser on one day (see A visitor is recognised for one day, at most, under Changed).

  What it deliberately cannot reach. Visitor-level data never appears on a public share link, in the public read API, in an export, or on the internal admin surface — four exclusions pinned by tests rather than by convention, because Pulse runs a live public demo through the share surface. Sessions Cerberus has convicted stay invisible here exactly as everywhere else.

  Some of our own wording had to change with it: several pages said Pulse keeps "no individual records" or is "architecturally incapable of identifying individual people". The second half of that was always the load-bearing part and is unchanged — Pulse still cannot tell you who someone is — but "no individual records" stopped being true the moment this page existed, so it has been rewritten rather than left to age.

Changed

• A visitor is recognised for one day, at most. From each site’s own midnight at the start of 27-10-2026, Pulse derives one id per visitor per day from the IP address and browser, with a random key made for that site and that day. Five minutes after the site’s day ends, Ciphera deletes the key and keeps no copy of it, so Pulse cannot recompute that day’s ids. Requests from the same IP address and browser are one visitor and one session within a day, and a reader first seen at 23:50 is recognised for ten minutes. No visitor id is written any more.

  Visitors over a range add up each day’s unique visitors, so a returning reader counts once for each day. This is the one rule for every day since a site joined Pulse. visitor_id is NULL on every row written before a site’s switch to one-day identity: the monthly ids of 26-08-2026..26-10-2026 were nulled on 27-10-2026, day-state and the day archive were rebuilt, and multi-day visitor figures for that period are restated upward. Imported history keeps the visitor figures its source reported. The public read API’s and MCP’s visitors field keeps its name and type, so there is no wire change.

  The identity window setting is retired: Session only, 24 hours, 7 days, 30 days and calendar month are gone, and values stored on sites have no effect. Tracking script 1.7.0 keeps nothing in the browser (no cookie, session storage or local storage) apart from the opt-out flag a site owner sets in their own browser, only when they open their own site with ?pulse-ignore; a reload within five seconds still counts once because the server applies that rule. Visitor views keep working, but each profile covers up to one day: profiles of 26-08-2026..26-10-2026 were rebuilt as one-day profiles on 27-10-2026, so a link to a month-long profile no longer resolves.

  In the dashboard: Settings → Privacy has no Visitor identity panel. The Visitor views caption now says how long a reader is recognised, and a note under the privacy-policy text asks you to replace it if you pasted the earlier version. The Visitors page reads "Data begins 26 Aug 2026 · each profile covers up to one day" and no longer shows a "% returning" share, which only ever described the rows on screen. A visitor's page shows when they were first seen, with no month ribbon and no reset date. On narrow screens the dot field's caption wraps above the dots instead of running into the live count.

• One view switcher, the same on every page. The date menu now lists the same twelve rows everywhere: Today, Yesterday, Last 7 days, Last 30 days, Last 3 months, Last 12 months, All time, then This month, Last month, This year, Last year, then Custom range…. It no longer scrolls, and Custom range… opens the calendar with a way back to the list. Dates read "23 Sep" (the year only when it is not this one).

  A row a page has no data for is greyed, with the reason — never hidden. Search Console reports each day about two days late, so Search greys Today and Yesterday; journeys are built overnight, so Journeys greys Today; visitor history starts 26 Aug 2026. When a range starts before a page's data or ends after it, the button says so: "Last 12 months · since 26 Aug", "Last 30 days · through 24 Sep".

  Removed from the menu: Last 1 hour, Last 24 hours, Last 28 days, Last 6 months, Last 16 months, Last week, Last quarter, Week to date and Quarter to date, and the page-specific groups on Search, CDN, Uptime and Visitors. Links that carry them still open, and the button shows their dates rather than the word "Custom". Performance keeps its own check stepper.

• One memory for the view. Pick Last 7 days on any page and every page opens on Last 7 days — on every site. A custom range, or one moved with the arrows, follows you until the tab closes. Opening a shared link never changes what you picked. On a page that has no data for your view, Pulse shows the closest view that does and names it on the button — Today on Search shows "24 Sep · latest day", on Journeys "Yesterday · latest day" — without changing what you picked.

• Realtime is the last 5 minutes, for the count and the view alike (the view was 30 minutes, the count 5, so the two could disagree side by side). The live count is smaller — a dot and the number, grey at zero — and it is still how you enter realtime. On Visitors it sits beside the view switcher and replaces the page's own live windows (30 minutes, 1, 6 and 24 hours). A realtime block with nobody in it says so in one line: "Nobody on the site in the last 5 minutes."

• Shared dashboards show the same twelve rows, with Today, Yesterday, Last 7 days and Last 30 days available and the rest greyed: "A shared dashboard shows fixed ranges." The live count under the site name is the same small dot and number, for display only.

• Share links open in Pulse's own dashboard. A link shows the pages it shares in a read-only version of the dashboard, with the same charts and cards you see. Its side rail lists only those pages, and a page the link does not share says "This page isn't shared." What a link shares, and who can open it, have not changed.

• The live demo is the real dashboard, on a sample site. pulse.ciphera.net/demo opens every page of Pulse (Dashboard, Pages, Journeys, Funnels, Performance, Uptime, Search and CDN) on Halden Cycles, a bike shop that does not exist. It has thirteen months of generated data, and new visits keep arriving while you look. The demo is labelled Sample data.

• The top bar reads "Updated 6 seconds ago" instead of "Live · 6 seconds ago": it is about when the page last refreshed, not about who is on the site.

• The steps of a visit are bigger, and each one branches off the line. In an expanded visit the page path, the sentences beneath it and their marks all stepped up a size, and every step now hangs from the visit's line by a short tick instead of merely sitting under its page. A 14-step visit is about a fifth taller than before; nothing new is boxed or bordered, because the line the eye already follows is what draws the hierarchy.

• Visit duration measures time people spent, and 04-09-2026 is a measurement boundary. The tracking script used to report the wall-clock time since a page loaded as its time on page. A tab left open overnight counted — even on a laptop that was asleep — and a hidden background tab that reloaded itself after a deploy started a visit nobody was on. Measured on production: 73% of the Pulse dashboard's own summed visit time came from single pages carrying more than 30 minutes, and one page carried eight and a half hours. Two defects in the server's arithmetic compounded it: the first page of a second visit in a day contributed zero instead of its own time, and a multi-page visit counted its first page twice while never counting its last.

  Tracking script v1.2.0 now measures engaged time — seconds the page was visible and the visitor active — in bounded one-second ticks, so a sleeping machine, a frozen tab or a walked-away desk adds at most a tick. The clock pauses while a tab is hidden and after two minutes without scrolling, clicking or typing, and resumes on activity. A page that loads hidden is not a pageview until it is shown; a URL rewrite that only changes the query string or hash is state, not a navigation (the dashboard's own metric picker had been minting a pageview per click). A page's time is credited to that page and never exceeds the gap to the next one.

  Expect visit duration to step down on most sites and pageviews to step down on single-page apps. Pages recorded before the boundary carry no engaged measurement and cannot be re-measured; they are bounded by their visible time and capped at 30 minutes each, and history is recomputed on that basis — on a few sites the average steps up, because the old arithmetic never read a visit's last page. The public read API's avg_duration is the same field with the corrected meaning, no wire change, as with visitors on 26-08-2026. An SRI-pinned embed on v1.1.0 keeps the old bytes and the old measurement until the tag is updated; the rolling js.ciphera.net/script.js embed picks the change up automatically. Audit: Pulse/docs/audits/04-09-2026-visit-duration-audit.md.

• Funnels, redrawn and simplified. The funnel page is now one chart and one sentence: tall gradient columns show each step's survivors against the entry total, the loss between steps is drawn as the wedge between columns with the drop and the median time to the next step written in the gap, and the headline — conversion, completed of entered, change vs the previous period, median time to convert — is stated once, above the chart, and nowhere else. The five-tile KPI band and the duplicated daily rails are gone; the daily chart and the drop-off and breakdown panels remain. The drop-off panel now names the step it describes and opens on the step that loses the most visitors. The breakdown panel now shows each segment's end-to-end funnel conversion (it used to follow the selected step, which made the default view read "100% conv" for every row — true only in the useless sense), and every breakdown dimension is available, not a curated seven. List cards carry the same chart in miniature. Conversion rates below 10% now show one decimal — a 0.4% funnel no longer prints "0%".

• Funnel steps may repeat a page or event — revisit funnels work now. A funnel like / → /pricing → / used to be rejected when saving ("a later duplicate step can never be matched") because the engine assigned each pageview to only one step. Matching is now evaluated per step, so a later step completes on any strictly-later matching event. Funnels whose steps don't overlap measure exactly as before; if two of your steps do overlap (say, a "contains" step that also covers an "exact" step's page), sequences the old engine silently missed are now counted — that is a correction, and numbers can step up slightly.

• Page "contains" steps are now case-insensitive, and %/_ match literally. This was the only case-sensitive "contains" in the product, and a literal percent or underscore in the value acted as a hidden wildcard. A contains step may match slightly more than before; exact and regex steps are unchanged.

• Funnel regexes are validated by the engine that runs them. Saving a funnel checks the pattern against the database's regex dialect, so a pattern that saves is a pattern that reads. Previously a pattern could pass the save-time check and then fail on every view of the funnel, forever.

• Funnels need at least two steps, exact page steps must start with /, and a site can hold up to 50 funnels. Creating and editing funnels and goals is now recorded in your organisation's audit trail.

• The tracking script sends engagement to a path ad blockers do not cancel, and 26-08-2026 is a measurement boundary for time-on-page and scroll depth. The beacon carrying duration, visible duration and scroll depth used to post to /api/v1/metrics. EasyPrivacy carries a bare, domain-agnostic substring rule for exactly that path — written for an unrelated vendor, matching ours by coincidence — so uBlock Origin, Brave and everything else shipping that list cancelled the request client-side while the pageview itself landed. Those visitors were counted, and their engagement was not. The script now posts to /api/v1/engagement; the old path stays live server-side indefinitely for scripts already cached at the edge and for SRI-pinned embeds. Expect time-on-page, visible time and scroll depth to step up. That is the instrument widening, not readers behaving differently, and it cannot be backfilled — a blocked beacon never reached us to be recovered. Measured before the change: 89.9% of pageviews carried a duration over 30 days, lowest on ciphera.net at 61.1%. The step will be smaller than that gap suggests, because the script also withholds the beacon by design when there is no genuine engagement to report. Ciphera is on no filter list; this was a path-name collision, verified against EasyPrivacy, EasyList, uBlock's uAssets, AdGuard and Disconnect. Analysis: Pulse/docs/audits/26-08-2026-psi-err-blocked-by-client-metrics.md.

• Tracking script v1.1.0. New bytes require a new immutable version, so the SRI-pinned embed snippet now offers v1.1.0. An existing pinned tag keeps working and keeps posting to the legacy path — a pin is a promise that those bytes never change, so adopting the fix means updating the tag. The rolling js.ciphera.net/script.js embed, which carries no integrity attribute, picks the fix up automatically.

• "Unique visitors" counted a returning reader once per calendar month, from 26-08-2026 to 26-10-2026. Visitor identity used to rotate every day, so a returning reader was re-counted once per day (and the public API's visitors field inherited that). From 26-08-2026 to 26-10-2026, identity was deduplicated within each calendar month in the site's own timezone: a returning reader counted once, on the dashboard and in the public read API's visitors field alike (same field, no wire change). Since 27-10-2026 a visitor is recognised for one day at most, and multi-day visitor figures for that period are restated upward as the sum of each day's unique visitors (see A visitor is recognised for one day, at most, under Changed). Session boundaries also moved from UTC midnight to the site's own midnight on 26-08-2026, which ended the long-standing off-by-one between the headline and the daily chart.

Removed

• Small numbers are no longer hidden anywhere. Every row and every metric now shows at any size, filtered or not. A shared dashboard shows the same top rows your team sees for the same range, a page or a city with one visitor included, and the line naming what it had hidden is gone. The read API, the CLI and the MCP tools answer a filter that matches one visitor with its real numbers, list a page in realtime however few visitors it has, and keep a small day's averages and a small filtered row in the exports. Funnel breakdowns list a value however few entrants it had, and a funnel's Daily chart no longer skips a day with fewer than five entrants. Fields kept for older clients say nothing was withheld (suppressed is false, the export headers are 0). Filters stay off on a shared link, and its ranges stay fixed.

• The notification bell and the /notifications page are gone. Pulse notifications arrive by email. The emails now link straight into Pulse. You switch off a category's emails in Settings → Account → Notifications, and /notifications redirects there, so bookmarks and older links keep working. The tour's "Alerts land here" step, the g n shortcut and the command palette's Notifications entry went with the page. Failed-payment, invoice and refund notices go by email to the workspace's billing contact, as they always have; the workspace's other members saw them only in the bell, so they no longer get them. The "Site added" notification is retired: it told the person who had just added a site that they had added one.

• The dashboard's Export button and its PDF are gone. Export lives in Settings → Site → Export now (see Added). The shared dashboard and the live demo lose their Export button too: a shared link is for looking at the numbers, not for downloading them. The old PDF, built in the browser, went with the button.

• The funnel conversion window is gone — it never did anything. The setting (24 hours to 30 days) shipped in March and was removed from the product in August: session identity resets at your site's midnight, so no conversion could ever span more than one session and every window setting measured identically (verified on production data before removal). Funnels state the real rule instead: a conversion counts when a visitor completes every step within one session. The March entry below is kept as history.

• The privacy scanner is gone. The Settings > Privacy scan — a single-request check that printed "Privacy score 100" for pages it could not meaningfully judge — has been removed end to end, including its stored results. The Privacy settings tab itself (page rules, path grouping, query-parameter allowlist) is unchanged.

• Scheduled email reports and outbound webhooks are gone; the Reports tab is now Alerts. Scheduled analytics reports and the notification-webhook integration have been removed. Uptime alert channels — email and in-app, fired when a monitor goes down or recovers — are unchanged and keep their tab (now named Alerts). Two fixes landed with the change: a paused alert channel no longer disappears from settings, and alert channels no longer consume report slots.

• Custom roles are gone. Roles are now the built-in three — Owner, Admin, Member — assigned through invite links. The Roles view remains as a read-only matrix of what each role can do. Existing memberships were unaffected; the only custom role ever created was a test artifact and was removed.

• The CDN page's world map is gone. It plotted bandwidth by Bunny edge datacenter, which read as visitor geography and was nothing of the kind. The ranked "Served from" region list — the honest version of the same data — remains, as does the Audience map (which really is visitor geography).

• The "Visitor recognition" setting is gone. The tracking script never read the storage attributes the control emitted — visitor identification has been fully server-side for months. Removing the control removes the pretense; nothing about tracking behavior changed.

• The Campaigns card's Export and Build URL buttons are gone. The card's own CSV download and the in-dashboard UTM builder (including the empty state's "Build a UTM URL" button) have been removed; the Source / Medium / Campaign / Term / Content tabs are unchanged. Campaign rows still ship in the dashboard's Export (the Campaigns sheet in the spreadsheet and the Campaigns table in the PDF), and the public UTM builder at /tools/utm-builder is untouched.

Changed

• A share password no longer travels in the URL. Password-protected share links now authorize only through the short-lived cookie set when the password is entered; a ?password= query parameter is ignored (it used to leak into browser history and server logs). The share page also re-prompts for the password when access expires instead of quietly showing stale numbers.

Pulse is 1.0 because its most public promise already was: the read API behind the CLI has been frozen additive-only for a minimum of 24 months since 07-08-2026, while the version string still said 0.15.0-alpha — which conventionally means the opposite. The version now agrees with the contract.

Not a feature release. Everything below has been in production and serving customers; this is the version number catching up with five months of work.

⚠️ The stability guarantee is the public read API's. The dashboard, its internal endpoints and the schema continue to change.

Added

• Pulse CLI and a public read API. A signed, Homebrew-installable client (brew install ciphera-net/tap/pulse) over an API-key read API whose wire format is frozen additive-only for 24 months.
• Uptime. Monitors, incident history and per-monitor latency, on UTC calendar days — labelled as such, because re-bucketing frozen daily rows on a timezone change is a defect this product has already paid for once. Latency percentiles read as an em dash where the raw checks have been purged, never as a zero.
• Search. Search Console rebuilt on daily totals that match Google's own chart, plus Bing daily clicks and impressions.
• CDN. Bunny bandwidth, requests, cache hit ratio and errors, with a live hourly view.
• Performance. Lighthouse measurement Pulse runs itself, with a visible provenance boundary at the point the instrument changed, and failed checks shown as failures rather than as stale numbers.
• Page Rules — control which pages appear in your analytics. A new "Page Rules" section in Settings > Privacy lets you exclude pages you don't want tracked (like /admin/* or /staging/*) and group dynamic pages into clean labels (like turning hundreds of /sites/abc-123-def entries into a single /sites/:id row). Rules are evaluated top-to-bottom — first match wins — and you can reorder them with up/down arrows. Excluded pages are hidden from all stats but never permanently deleted, so you can change your mind and bring them back anytime.
• Automatic grouping of dynamic paths. Enabled by default, Pulse now automatically detects UUIDs, numeric IDs, and long tokens in your page paths and replaces them with :id. Instead of seeing 500 separate entries like /posts/12345 and /posts/67890, you see one clean /posts/:id row with the combined total. Works out of the box — no setup needed. You can toggle it off in Settings > Privacy if you prefer to see the raw paths.
• Cleaner page paths by default. Query parameters like session tokens, auth codes, and cache busters are now automatically stripped from your page stats. Instead of seeing /search?q=shoes&session=abc123 cluttering your Top Pages, you see just /search. If you need specific parameters (like q for search queries), add them to the allowlist in Settings > Privacy — everything else is removed automatically.
• Self-tracking analytics. Pulse now tracks its own usage with the Pulse script, so you can see how your team uses the dashboard.
• Funnels now track actions, not just pages. When creating or editing a funnel, you can now choose between "Page Visit" and "Custom Event" for each step. Page Visit steps work as before — matching URLs. Custom Event steps let you track specific actions like signups, purchases, or button clicks. You can also add property filters to event steps (e.g., "purchase where plan is pro") to get even more specific about what you're measuring.
• Edit your funnels. You can now edit existing funnels — change the name, description, steps, or conversion window without having to delete and recreate them. Click the pencil icon on any funnel's detail page.
• Conversion window. Funnels now have a configurable time limit. Visitors must complete all steps within your chosen window (e.g., 7 days, 24 hours) to count as converted. Set it when creating or editing a funnel — quick presets for common windows, or type your own. Default is 7 days.
• Filter your funnels. Apply the same filters you use on the dashboard — by device, country, browser, UTM source, and more — directly on your funnel stats. See how your funnel performs for mobile visitors vs desktop, or for traffic from a specific campaign.
• See where visitors go after dropping off. Each funnel step now shows the top pages visitors navigated to after leaving the funnel. A quick preview appears inline, and you can expand to see the full list. Helps you understand why visitors aren't converting.
• Conversion trends over time. A new chart below your funnel shows how conversion rates change day by day. See at a glance whether your funnel is improving or degrading. Toggle individual steps on or off to pinpoint which step is changing.
• Step-level breakdowns. Click any step in your funnel stats to open a breakdown panel showing who converts at that step — split by device, country, browser, or traffic source. Useful for spotting segments that convert better or worse than average.
• Up to 8 steps per funnel. The step limit has been increased from 5 to 8, so you can track longer user journeys like multi-page onboarding flows or detailed checkout processes.
• BunnyCDN integration. Connect your BunnyCDN account in Settings > Integrations to monitor your CDN performance right alongside your analytics. A new "CDN" tab on your dashboard shows total bandwidth served, request volume, cache hit rate, origin response time, and error counts — each with percentage changes compared to the previous period. Charts show bandwidth trends (total vs cached), daily request volume, and error breakdowns over time. A geographic breakdown shows which countries consume the most bandwidth. When connecting, Pulse automatically filters your pull zones to only show ones matching your site's domain. Pulse only stores your API key encrypted and only reads statistics — it never modifies anything in your BunnyCDN account. You can disconnect and fully remove all CDN data at any time.
• Google Search Console integration. Connect your Google Search Console account in Settings > Integrations to see which search queries bring visitors to your site. A new "Search" tab on your dashboard shows total clicks, impressions, average CTR, and average ranking position — with percentage changes compared to the previous period. Browse your top search queries and top pages in sortable, paginated tables. Click any query to see which pages rank for it, or click any page to see which queries drive traffic to it. A trend chart shows how clicks and impressions change over time, and a green badge highlights new queries that appeared this period. Pulse only requests read-only access to your Search Console data, encrypts your Google credentials, and lets you disconnect and fully remove all search data at any time.
• Free plan now visible on the Pricing page. The free tier is no longer hidden — it's displayed as the first option on the Pricing page so you can see exactly what you get before signing up: 1 site, 5,000 monthly pageviews, and 6 months of data retention, completely free.
• Free plan limited to 1 site. Free accounts are now limited to a single site. If you need more, you can upgrade to Solo or above from the Pricing page.

Changed

• A shared dashboard shows aggregates only. Breakdown rows describing fewer than five visitors are withheld, and the page says how many were withheld so the numbers still add up. Shared dashboards are also noindex now: robots.txt already disallowed them, but the page itself was emitting the app's default index, follow, and the two directives disagreed.
• A granted plan says "Grant ends", not "Renews". A grant's end date and a charge date are different facts and now travel in different fields; the billing page had been announcing a renewal for a date on which no money would move.

Improved

• PageSpeed scores you can actually trust. Every check now runs Lighthouse three times and stores the middle result, instead of reporting a single run. A single run of an unchanged page moves by 20 points or more, which meant the trend chart was largely drawing noise and score-drop emails were sometimes triggered by it. The chart itself now has a fixed 0–100 scale, shows each individual check as a dot alongside the trend line, and marks the date the measurement method changed — so older, single-run history is visibly labelled as such rather than silently mixed in. Checks also run on Ciphera's own infrastructure now, so your site's address is no longer sent to a third-party API on a schedule.
• PageSpeed tells you when a check fails. A failed check used to leave no trace at all: the page simply kept showing the previous result under today's date. Now the header says the check failed, why, and that the numbers below are from the last successful run — with a button to try again. The same is true if the page can't load your settings: it says so, instead of showing "monitoring is off" for a site where it is switched on. A measurement that was never taken shows a dash rather than a zero.
• The marketing site got a redesign. The homepage, pricing, features, about, FAQ, installation, integrations, and changelog pages now share the same bordered layout as ciphera.net, with numbered sections so you always know where you are on a long page. Pages load faster and calmer — content is visible the moment the page loads instead of fading in as you scroll, and every page has a real, readable heading. The changelog itself is now collapsible with working links straight to a specific release, the pricing toggle can be operated fully from the keyboard, and the FAQ's category filters and accordions are too.
• The Behavior page now tells you where the frustration is. Click any row in "Frustration by page" to focus the whole page on it — the rage click and dead click tables instantly narrow to that page's elements, and the filter lives in the URL so you can share a link straight to "here's what's broken on /pricing". The old donut chart is replaced by a real day-by-day trend of rage and dead clicks, and scroll depth is now four clean bars instead of a radar chart. Stat changes versus the previous period only appear when there's enough history to compare against, so you'll no longer see a meaningless "-100%" on a brand-new site.
• The Search page is now the full Search Console experience. Alongside top queries and pages you can now browse clicks by country, by device, and — most usefully — an Opportunities view: queries ranking just off the first page where a better title or snippet could win real clicks, with the potential shown next to each. Expanding a query now also charts how its ranking position moved over the period. Clicks and impressions finally get their own scales on the traffic chart, so clicks no longer flatline against the impression counts. A "new queries" chip lists exactly which searches appeared this period, the page shows when your data last synced, and the view, page number, and expanded row all live in the URL.
• The CDN page now shows what your cache is actually doing. The bandwidth chart splits traffic into "served from cache" versus "fetched from your origin", with the cache hit rate for each day in the tooltip — so you can see your CDN earning its keep (or not). Requests get the same cached/uncached split, a new chart tracks your origin's response time over the period, error bars now use honest colors (redirects are no longer painted as errors), and the geographic breakdown is a ranked list of datacenters with their real share of traffic.
• Funnels got a full page of their own. Every funnel now opens as a real page with its own link you can share or bookmark. The list shows compact summary rows — the actual pages and events in each funnel, the conversion rate with a comparison to the previous period, and a small trend line — instead of expanding accordions. The detail page has a stats band (conversion, visitors, converted, biggest drop-off, median time), a visual funnel canvas where each step is a column filled to its conversion level with connecting bands between steps, and everything — date range, filters, selected step — lives in the URL so a refresh or a shared link lands exactly where you were.
• Funnel editing no longer resets your conversion window. Editing a funnel used to silently rewrite its conversion window to 30 days no matter what you had configured. The create/edit dialog now has a real window control (with 24h, 72h, 7d, 14d and 30d presets) that saves exactly what it shows.
• Funnel steps suggest your real pages and events. When building a funnel, the path field now suggests your most-visited pages and the event field suggests your tracked events — with visit counts — so you don't have to remember exact paths. Free text still works.
• Journeys controls got out of the data's way. The oversized control block is now one compact row — steppers for depth and paths, a searchable entry-point picker, and a Columns/Flow switch. Connections between steps are always visible as subtle ribbons, and hovering any page lights up its full path through the site.
• Pin and share a journey path. Clicking a page in either journeys view pins it as a "lens" — the whole chain through that page highlights, an exit card shows where people left, and the selection lives in the URL so you can share exactly what you're looking at. From a pinned lens you can create a funnel of that path in one click, and funnel steps link back to journeys starting from that page.
• No more flashing while journeys and funnels load. Changing depth, entry point, or date range used to swap the entire page to a loading skeleton on every tweak. Now the data stays visible and morphs to the new values, with a small "Updating…" chip when a fetch takes longer than usual. Failed loads show a clear error with a Retry button instead of pretending you have no data, and an entry filter with no matches says so instead of showing the generic empty state.
• Redesigned Search card on the dashboard. The Search section of the dashboard has been completely refreshed to match the rest of Pulse. Search queries now show proportional bars so you can visually compare which queries get the most impressions. Hovering a row reveals the impression share percentage. Position badges are now color-coded — green for page 1 rankings, orange for page 2, and red for queries buried beyond page 5. You can switch between your top search queries and top pages using tabs, and expand the full list in a searchable popup without leaving the dashboard.
• Smaller, faster tracking script. The tracking script is now about 20% smaller. Logic like page path cleaning, referrer filtering, error page detection, and input validation has been moved from your browser to the Pulse server. This means the script loads faster on every page, and Pulse can improve these features without needing you to update anything.
• Automatic 404 page detection. Pulse now detects error pages (404 / "Page Not Found") automatically on the server by reading your page title — no extra setup needed. Previously this ran in the browser and couldn't be improved without updating the script. Now Pulse can recognize more error page patterns over time, including pages in other languages, without any changes on your end.
• Smarter bot filtering. Pulse now catches more types of automated traffic that were slipping through — like headless browsers with default screen sizes, bot farms that rotate through different locations, and bots that fire duplicate events within milliseconds. Bot detection checks have also been moved from the tracking script to the server, making the script smaller and faster for real visitors.
• Actionable empty states. When a dashboard section has no data yet, you now get a direct action — like "Install tracking script" or "Build a UTM URL" — instead of just passive text. Gets you set up faster.
• Animated numbers across the dashboard. Stats like visitors, pageviews, bounce rate, and visit duration now smoothly count up or down when you switch date ranges, apply filters, or when real-time visitor counts change — instead of just jumping to the new value.
• Inline bar charts on dashboard lists. Pages, referrers, locations, technology, and campaigns now show subtle proportional bars behind each row, making it easier to compare values at a glance without reading numbers.
• Redesigned Journeys page. The Journeys page has been rebuilt — the depth slider now matches the rest of the UI and goes up to 10 steps, controls are integrated into the chart card, and Top Paths uses a clean compact list with inline bars instead of bulky cards.
• More reliable visit duration tracking. Visit duration was silently dropping to 0s for visitors who only viewed one page — especially on mobile or when closing a tab quickly. The tracking script now captures time-on-page more reliably across all browsers, and sessions where duration couldn't be measured are excluded from the average instead of counting as 0s. This makes the Visit Duration metric, Journeys, and Top Paths much more accurate.
• More accurate rage click detection. Rage clicks no longer fire when you triple-click to select text on a page. Previously, selecting a paragraph (a normal 3-click action) was being counted as a rage click, which inflated frustration metrics. Only genuinely frustrated rapid clicking is tracked now.
• Fresher CDN data. BunnyCDN statistics now refresh every 3 hours instead of once a day, so your CDN tab shows much more current bandwidth, request, and cache data.
• More accurate dead click detection. Dead clicks were being reported on elements that actually worked — like close buttons on cart drawers, modal dismiss buttons, and page content areas. Three fixes make dead clicks much more reliable:
  • Buttons that trigger changes elsewhere on the page (closing a drawer, opening a modal) are no longer flagged as dead.
  • Page content areas that aren't actually clickable (like <main> containers) are no longer treated as interactive elements.
  • Single-page app navigations are now properly detected, so links that use client-side routing aren't mistakenly reported as broken.
• Journeys page now shows data on low-traffic sites. The Journeys page previously required at least 2–3 sessions following the same path before showing any data. It now shows all navigation flows immediately, so you can see how visitors move through your site from day one.
• European date and time formatting. All dates across Pulse now use day-first ordering (14 Mar 2025) and 24-hour time (14:30) instead of the US-style month-first format. This applies everywhere — dashboard charts, exports, billing dates, invoices, uptime checks, audit logs, and more.
• Sites now show their verification status. Each site on your dashboard now displays either a green "Active" badge (if verified) or an amber "Unverified" badge. The Settings page also shows a green confirmation bar once verified. When you verify your tracking script installation, the status is saved permanently — no more showing "Active" for sites that haven't been set up yet.
• Cleaner page paths in your reports. Pages like /products?_t=123456 or /about?session=abc now correctly show as /products and /about. Trailing slashes are also normalized — /about/ and /about count as the same page. Only marketing attribution parameters (like UTM tags) are preserved for traffic source tracking — all other junk parameters are automatically removed, so your Top Pages and Journeys stay clean.
• Easier to hover country dots on the map. The orange location markers on the world map are now much easier to interact with — you no longer need pixel-perfect aim to see the tooltip.
• Smoother chart curves and filled area. The dashboard chart line now flows with natural curves instead of sharp flat tops at peaks. The area beneath the line is filled with a soft transparent orange gradient that fades toward the bottom, making trends easier to read at a glance.
• Smoother loading transitions. When your data finishes loading, the page now fades in smoothly instead of appearing all at once. This applies across Dashboard, Journeys, Funnels, Behavior, Uptime, Settings, Notifications, and shared dashboards. If your data was already cached from a previous visit, it still loads instantly with no animation — the fade only kicks in when you're actually waiting for fresh data.
• Faster tab switching across the board. Switching between Settings, Funnels, Uptime, and other tabs now shows your data instantly instead of flashing a loading skeleton every time. Previously visited tabs remember their data and show it right away, while quietly refreshing in the background so you always see the latest numbers without the wait.

Removed

• The Behavior page is gone, and scroll depth moved to your dashboard. Frustration tracking is fully retired, so the Behavior page has been removed along with the rage-click and dead-click reports. Scroll depth is not going anywhere — the 25 / 50 / 75 / 100% distribution now sits on your main dashboard alongside the other breakdowns, where it responds to your filters like everything else. Per-page scroll depth on Top Pages, the Engagement score, exports and the public API are all unchanged. The G B shortcut is retired with the page.
• Frustration and interaction tracking are being retired. The "Frustration tracking" and "Interaction tracking" toggles are gone from your site's tracking settings, and neither add-on script is offered any more. Pulse now ships a single tracking script. Frustration tracking recorded a CSS selector and click coordinates for the element you clicked — the most identifying thing Pulse collected — and it is going away. The Behavior page still shows existing data for now, and carries a notice. Scroll depth is not affected: it comes from the core script, stays exactly as it is, and moves to your main dashboard when the Behavior page is retired.
• Performance insights removed. The Performance tab, Core Web Vitals tracking (LCP, CLS, INP), and the "Enable performance insights" toggle in Settings have been removed. The tracking script no longer collects Web Vitals data. Visit duration tracking continues to work as before.

Fixed

• Your BunnyCDN API key is no longer visible in network URLs. When loading pull zones, the API key was previously sent as a URL parameter. It's now sent securely in the request body, just like when connecting.
• No more "Site not found" when switching back to Pulse. If you left Pulse in the background and came back, you could see a wall of errors and a blank page. This happened because the browser fired several requests at once when the tab regained focus, and if any failed, they all retried repeatedly — flooding the connection and making it worse. Failed requests now back off gracefully instead of retrying in a loop.
• No more random errors when switching tabs. Navigating between Dashboard, Funnels, Uptime, and Settings no longer shows "Invalid credentials", "Something went wrong", or "Site not found" errors. This was caused by a timing issue when your login session refreshed in the background while multiple pages were loading at the same time — all those requests now wait for the refresh to finish and retry cleanly.
• More accurate pageview counts. Refreshing a page no longer inflates your pageview numbers. The tracking script now detects when the same page is loaded again within a few seconds and skips the duplicate, so metrics like total pageviews, pages per session, and visit duration reflect real navigation instead of reload habits.
• Self-referrals no longer pollute your traffic sources. Internal navigation within your own site (e.g. clicking from your homepage to your about page) no longer shows your own domain as a referrer. Only external traffic sources appear in your Referrers panel now.
• Screen size fallback now works correctly. A variable naming issue prevented the fallback screen dimensions from being read when the primary value wasn't available. Screen size data is now reliably captured on all browsers.
• Browser back/forward no longer double-counts pageviews. Pressing the back or forward button could occasionally register two pageviews instead of one. The tracking script now correctly deduplicates these navigations.
• Preloaded pages no longer count as visits. Modern browsers sometimes preload pages in the background before you actually visit them. These ghost visits no longer inflate your pageview counts — only pages the visitor actually sees are tracked.
• Marketing parameters no longer fragment your pages. Pages like /about?utm_source=google and /about?utm_campaign=spring now correctly show as just /about in your Top Pages. UTM tags, Facebook click IDs, Google click IDs, and other tracking parameters are stripped from the page path so all visits to the same page are grouped together.
• Traffic sources are no longer over-counted. When a visitor arrived from Facebook (or any external source) and browsed multiple pages, every page was credited to Facebook instead of just the first. Now only the landing page shows the referrer, giving you accurate traffic source numbers.
• UTM attribution now works correctly. Visitors arriving via campaign links (e.g. from Facebook Ads, Google Ads, or email campaigns) now have their traffic source, medium, and campaign properly recorded. Previously, this data was accidentally lost before it reached the server.
• Outbound links and file downloads now show the URL. Previously you could only see how many outbound clicks or downloads happened. Now you can see exactly which external links visitors clicked and which files they downloaded.
• Dead click detection no longer triggers on form fields. Clicking on a text input, dropdown, or text area to interact with it is normal — it no longer gets flagged as a dead click.

Added

• User Journeys tab. A new "Journeys" tab on your site dashboard visualizes how visitors navigate through your site. A Sankey flow diagram shows the most common paths users take — from landing page through to exit — so you can see where traffic flows and where it drops off. Filter by entry page, adjust the depth (2-10 steps), and click any page in the diagram to drill into paths through it. Below the diagram, a "Top Paths" table ranks the most common full navigation sequences with session counts and average duration.

Removed

• Realtime visitors detail page. The page that showed individual active visitors and their page-by-page session journey has been removed. The live visitor count on your dashboard still works — it just no longer links to a separate page.

Added

• Rage click detection. Pulse now detects when visitors rapidly click the same element 3 or more times — a strong signal of UI frustration. Rage clicks are tracked automatically (no setup required) and surfaced in the new Behavior tab with the element, page, click count, and number of affected sessions.
• Dead click detection. Clicks on buttons, links, and other interactive elements that produce no visible result (no navigation, no DOM change, no network request) are now detected and reported. This helps you find broken buttons, disabled links, and unresponsive UI elements your visitors are struggling with.
• Behavior tab. A new tab in your site dashboard — alongside Dashboard, Uptime, and Funnels — dedicated to user behavior signals. Houses rage clicks, dead clicks, a by-page frustration breakdown, and scroll depth (moved from the main dashboard for a cleaner layout).
• Frustration summary cards. The Behavior tab opens with three at-a-glance cards: total rage clicks, total dead clicks, and total frustration signals with the most affected page — each with a percentage change compared to the previous period.
• Scheduled Reports. You can now get your analytics delivered automatically — set up daily, weekly, or monthly reports sent straight to your email, Slack, Discord, or any webhook. Each report includes your key stats (visitors, pageviews, bounce rate), top pages, and traffic sources, all in a clean branded format. Set them up in your site settings under the new "Reports" tab, and hit "Test" to preview before going live. You can create up to 10 schedules per site.
• Time-of-day report scheduling. Choose when your reports arrive — pick the hour, day of week (for weekly), or day of month (for monthly). Schedule cards show a human-readable description like "Every Monday at 9:00 AM (UTC)."

Changed

• Scroll depth moved to Behavior tab. The scroll depth radar chart has been relocated from the main dashboard to the new Behavior tab, where it fits more naturally alongside other user behavior metrics.

Fixed

• Region names now display correctly. Some regions were showing as cryptic codes like "14" (Poland), "KKC" (Thailand), or "IDF" (France) instead of their actual names. The Locations panel now shows proper region names like "Masovian", "Khon Kaen", and "Île-de-France."

Improved

• Smarter referrer attribution. Traffic that arrives without a referrer on a deep page (like a blog post) is now shown as "Shared Link" instead of "Direct." Real direct traffic — visitors who land on your homepage — still shows as "Direct." This gives you a much clearer picture of where your traffic actually comes from, since most unattributed deep-page visits are people clicking links shared in messaging apps or AI chatbots that strip the referrer header.
• More in-app browsers detected. Pulse now recognises visits from WhatsApp, Telegram, Snapchat, Pinterest, Reddit, and Threads in-app browsers and attributes them correctly instead of lumping them into "Direct."
• Dashboard blocks are now consistent in height. The Goals & Events and Scroll Depth panels now match the height of every other block on the dashboard.
• Cleaner period picker. The date range dropdown now has visual separators between the rolling windows (Today, Last 7 days, Last 30 days), the calendar periods (This week, This month), and Custom — so it's easy to tell them apart at a glance.
• New date range options. The period selector now includes "This week" (Monday to today) and "This month" (1st to today) alongside the existing rolling windows. Your selection is remembered between sessions.
• Smarter comparison labels. The "vs …" label under each stat now matches the period you're viewing — "vs yesterday" for today, "vs last week" for this week, "vs last month" for this month, and "vs previous N days" for rolling windows.
• Refreshed stat headers. The Unique Visitors, Total Pageviews, Bounce Rate, and Visit Duration stats at the top of the chart have a new look — uppercase labels, the percentage change shown inline next to the number, and an orange underline on whichever metric you're currently graphing.
• Consistent green and red colors. The up/down percentage indicators now use the same green and red as the rest of the app, instead of slightly different shades.
• Scroll Depth is now a radar chart. The Scroll Depth panel has been redesigned from a bar chart into a radar chart. The four scroll milestones (25%, 50%, 75%, 100%) are plotted as axes, with the filled shape showing how far visitors are getting through your pages at a glance.
• Polished Goals & Events panel. The Goals & Events block on your dashboard got a visual refresh to match the style of the Pages, Referrers, and Locations panels. Counts are shown in a consistent style, and hovering any row reveals what percentage of total events that action accounts for — sliding in smoothly from the right.
• Smarter bot protection. The security checks on shared dashboard access and organization settings now use action-specific tokens tied to each page. A token earned on one page can't be reused on another, making it harder for automated tools to bypass the captcha.
• More resilient under Redis outages. If the caching layer goes down temporarily, Pulse now continues enforcing rate limits using an in-memory fallback instead of letting all traffic through unchecked. This prevents one infrastructure hiccup from snowballing into a bigger problem.
• Better handling of traffic bursts. The system can now absorb 5x larger spikes of incoming events before applying backpressure. When events are dropped during extreme bursts, the system now tracks and logs exactly how many — so we can detect and respond to sustained overload before it affects your data.
• Faster map and globe loading. The interactive 3D globe and dotted map in the Locations panel now only load when you scroll down to them, instead of rendering immediately on page load. This makes the initial dashboard load faster and saves battery on mobile devices.
• Real-time updates work across all servers. If Pulse runs on multiple servers behind a load balancer, real-time visitor updates now stay in sync no matter which server you're connected to. Previously, you might miss live visitor changes if your connection landed on a different server than the one fetching data.
• Lighter memory usage in long sessions. If you manage many sites and keep Pulse open for hours, the app now automatically clears out old cached data for sites you're no longer viewing. This keeps the tab responsive and prevents it from slowly using more and more memory over time.
• Cleaner login storage. Temporary data left behind by abandoned sign-in attempts is now cleaned up automatically when the app loads. This prevents clutter from building up in your browser's storage over time.
• Tidier annotation display. If you've added a lot of annotations to your chart, only the 20 most recent are shown as lines on the chart to keep it readable. A "+N more" label lets you know there are additional annotations.
• Even faster dashboard loading. Your dashboard now fetches all its data — pages, locations, devices, referrers, performance, and goals — in a single request instead of seven separate ones. This means the entire dashboard appears at once rather than sections loading one by one, and puts much less strain on the server when many people are viewing their analytics at the same time.
• Smoother real-time updates. The real-time visitors page now streams updates instantly from the server instead of checking for new data every few seconds. Visitors appear and disappear in real-time with no delay, and the page uses far fewer server resources — especially when many people are watching their live traffic at the same time.
• More reliable under heavy load. Database queries now have automatic time limits so a single slow query can never lock up the system. If your dashboard or stats take too long to load, the request is gracefully cancelled instead of hanging forever — keeping everything responsive even during traffic spikes.
• Smarter caching for dashboard data. Your dashboard stats are now cached for longer and shared more efficiently between requests. When the cache refreshes, only one request does the work while others wait for the result — so your dashboard loads consistently fast even when lots of people are viewing their analytics at the same time.
• Faster filtered views. When you filter your dashboard by country, browser, page, or any other dimension, the results are now cached so repeat views load instantly. If multiple people apply the same filter, only one lookup runs and the result is shared — making filtered views much snappier under heavy use.
• Faster entry and exit page stats. The queries that figure out which pages visitors land on and leave from have been rewritten to be much more efficient. Instead of sorting through every single event, they now look up just the first and last page per visit — so your Entry Pages and Exit Pages panels load noticeably faster, especially on high-traffic sites.
• Faster goal stats. The Goals panel on your dashboard now loads faster, especially for sites with many custom events. Goal names are now looked up in a single step instead of one at a time.
• Fairer performance under heavy traffic. One busy site can no longer slow down dashboards for everyone else. Each site now gets its own dedicated share of server resources, so your analytics stay fast and responsive even when other sites on the platform are experiencing traffic spikes.
• Smoother exports. Exporting your data to PDF, Excel, or CSV no longer freezes the page. You'll see a clear "Exporting..." indicator while your file is being prepared, and the rest of the dashboard stays fully interactive.
• Smoother "View All" popups. Opening the expanded view for Pages, Locations, Technology, Referrers, or Campaigns now scrolls smoothly even with hundreds of items. Only the rows you can see are rendered, so the popup opens instantly on any device.
• Faster daily stats processing. Behind the scenes, the system that calculates your daily visitor stats now automatically scales up when there are more sites to process — so your dashboard numbers stay accurate and up to date even as the platform grows.
• More reliable background processing. When multiple servers are running, long-running background tasks like daily stats calculations no longer risk being interrupted or duplicated. The system now keeps its coordination lock active for as long as the task is running.

Added

• Peak Hours heatmap. A new panel on your dashboard shows a 7×24 grid of when your visitors are most active — every day of the week against every hour of the day. Cells glow brighter in brand orange the busier that hour is. Hover any cell to see the exact pageview count. No other indie analytics tool surfaces this on the main dashboard.
• Interactive 3D Globe. The Locations panel now has a "Globe" tab showing your visitor locations on a beautiful, interactive 3D globe. Drag to rotate, and orange markers highlight where your visitors are — sized by how much traffic each country sends. The globe slowly auto-rotates and adapts to light and dark mode.
• Dotted world map. The "Map" tab in Locations now uses a sleek dotted map style instead of the old filled map. Country markers glow in brand orange and show a tooltip with the country name and pageview count when you hover.
• Hide unknown locations. New toggle in Site Settings under Data & Privacy to hide "Unknown" entries from your Locations panel. When geographic data can't be determined for a visitor, it normally shows as "Unknown" in countries, cities, and regions. Turn this on to keep your location stats clean and only show resolved locations.
• Chart annotations. Mark events on your dashboard timeline — like deploys, campaigns, or incidents — so you always know why traffic changed. Click the + button on the chart to add a note on any date. Annotations appear as colored markers on the chart: blue for deploys, green for campaigns, red for incidents. Hover to see the details. Team owners and admins can add, edit, and delete annotations; everyone else (including public dashboard viewers) can see them.

Improved

• Beautiful funnel visualization. Funnel reports now show a smooth, animated funnel shape instead of a plain bar chart. Each step flows into the next with curved segments, hover effects, and labels showing visitor counts and conversion percentages at a glance.
• Tidier dashboard layout. The tab navigation (Dashboard, Uptime, Funnels, Settings) now sits above your site name and controls, keeping the tabs front and center.
• Instant tab switching. Clicking between Dashboard, Uptime, Funnels, and Settings now feels instant — the tab bar stays in place while the page content loads below it, instead of the whole screen flashing with a loading skeleton.
• Smooth tab animations. Switching tabs now plays a sliding indicator animation on the active tab and a subtle crossfade on the page content, making navigation feel polished and responsive.
• Cleaner focus styles. Buttons, tabs, and links no longer show an orange outline when you click them — the focus ring now only appears when navigating with the keyboard, keeping the interface clean.
• Faster dashboard loading. Switching to the Dashboard and Map tabs is now instant — no more brief lag or delay when navigating between sections.
• Expand icon for data panels. Pages, Referrers, Locations, Technology, and Campaigns panels now show a small expand icon next to the title when there's more data to see, replacing the old "View all" button at the bottom.
• Better expanded views. When you expand a data panel, the popup is now wider and taller so you can see more at once. Each row shows a percentage on hover, clicking a row filters your dashboard, and there's a search bar at the top to quickly find what you're looking for.
• Smoother theme switching. Toggling between light and dark mode now plays a satisfying circular reveal animation that expands from the toggle button, instead of everything just flipping instantly.
• Cleaner site navigation. Dashboard, Uptime, Funnels, and Settings now use an underline tab bar instead of floating buttons. The active section is highlighted with an orange underline, making it easy to see where you are and switch between views.
• Consistent icon style. All dashboard icons now use a single, unified icon set for a cleaner look across Technology, Locations, Campaigns, and Referrers panels.

Fixed

• Correct Instagram attribution. Visits from Instagram's in-app browser were showing as "Facebook" because Instagram routes shared links through Facebook's URL redirector. Pulse now checks the User-Agent to detect the real source app.
• Android and iOS now show up in OS stats. A bug in the User-Agent parsing order meant Android was always classified as "Linux" (because Android UAs contain "Linux") and iOS as "macOS" (because iPhone UAs contain "like Mac OS X"). Both are now detected correctly.
• Charts no longer show tomorrow's date. The visitor chart on 7-day and 30-day views could display the next day with zero traffic, making it look like a sudden drop. The chart now ends on today.
• Capitalized technology labels. Device types, browsers, and OS names in the Technology panel now display with a capital first letter (e.g. "Desktop" instead of "desktop").
• Login no longer gets stuck after updates. If you happened to have Pulse open when a new version was deployed, logging back in could get stuck on a loading screen. The app now automatically refreshes itself to pick up the latest version.
• City and region data is now accurate. Location data was incorrectly showing the CDN server's location (e.g. Paris, Villeurbanne) instead of the visitor's actual city. Fixed by reading the correct visitor IP header from Bunny CDN.
• "Reset Data" now clears everything. Previously, resetting a site's data in Settings only removed pageviews and daily stats. Uptime check history, uptime daily stats, and cached dashboard data were left behind. All collected data is now properly cleared when you reset, while your site configuration, goals, funnels, and uptime monitors are kept.

Added

• Dashboard filtering. Filter your entire dashboard by any dimension — browser, country, page, device, OS, referrer, or UTM parameters. A single "Filter" button lets you browse dimensions, see real values from your data with visitor counts, search or type a custom value, and apply — all in a quick dropdown. Active filters appear as removable pills above your charts. Stack multiple filters to narrow things down. Filters are saved in the URL so you can bookmark or share a filtered view.
• Click any item to filter. Click a referrer, browser, country, page, or any other item in your dashboard panels to instantly filter the entire dashboard to just that traffic.
• Hover percentages. Hover over any item in Pages, Locations, Technology, or Referrers to see what percentage of total traffic it represents.
• Custom event properties. Your custom events can now carry extra context — for example, pulse.track('signup', { plan: 'pro', source: 'landing' }). Click any event in Goals & Events to see a breakdown of its properties and values, no setup needed.
• AI traffic source identification. Pulse recognizes visitors from ChatGPT, Perplexity, Claude, Gemini, Copilot, DeepSeek, Grok, Meta AI, You.com, and Phind. These appear in Referrers with proper icons and names instead of raw URLs.
• Automatic outbound link tracking. Tracks when visitors click links to other websites. Shows up as "outbound link" events in Goals & Events — no setup needed.
• Automatic file download tracking. Downloads of PDFs, ZIPs, Excel, Word, MP3s, and 20+ other formats are recorded as "file download" events automatically.
• Automatic 404 detection. Detects when visitors land on pages that don't exist and records "404" events so you can find and fix broken links.
• Automatic scroll depth tracking. Tracks how far visitors scroll — at 25%, 50%, 75%, and 100% — helping you understand which content keeps people reading.

Improved

• Chart rebuilt from scratch. Cleaner stat cards, wider Y-axis that no longer clips labels, whole-number ticks for visitor and pageview counts, lighter grid lines, streamlined toolbar, and a properly positioned live indicator.
• Campaigns panel redesigned. Clean row-based layout with UTM medium and campaign always visible below the source name. Now sits in a half-width grid next to Goals & Events.
• Better filter design. Solid brand-colored filter pills that are easy to spot in light and dark mode. A funnel icon on the filter button. Click any pill to remove it.
• Underline tab switchers. Pages, Locations, and Technology panels now use clean underline tabs instead of pill-style switchers.
• "View all" at the bottom. The expand action on each panel is now a subtle "View all" link at the bottom of the list instead of an icon in the header.
• Faster dashboard loading. Each section loads independently with smart caching. Data refreshes in the background, and switching tabs pauses updates to save resources — resuming when you return.
• Smoother navigation. Switching pages, changing organizations, or signing in no longer triggers unnecessary background requests.
• Loading screen while redirecting to sign-in. The login page now shows the Pulse logo and a message instead of a blank white screen.
• More reliable billing. Plan changes, cancellations, and invoice views now handle session expiry and errors gracefully.
• Stronger browser security. Your browser now only loads scripts, styles, and images from trusted sources, adding protection against cross-site scripting.
• More resilient analytics processing. The system that processes your events now recovers automatically from unexpected errors instead of stopping silently.
• Dashboard stays responsive under heavy traffic. Parallel queries are limited during peak usage, and in-progress queries are cancelled when you navigate away.
• Cleaner error messages. Invalid form submissions show a simple message instead of exposing internal details.

Fixed

• Tracking script now works on all tracked websites. Page views were silently failing due to two separate issues. Both are fixed — your dashboard receives visits from all registered domains as expected.
• Rate limiting works correctly. A bug was treating all visitors as the same person, so one heavy user could block everyone. Each visitor is now identified individually.
• Real-time visitor count no longer stops updating. The live counter would hit a rate limit and stop refreshing. It now has enough headroom for normal usage.
• Team members can view real-time data. Previously only the site creator could see live visitors. Now any team member in the same organization has access.
• Funnel details load correctly. Opening a funnel previously showed an error. Funnels now display step-by-step conversion data as expected.
• Consistent date handling. Funnels now use the same date format as the rest of Pulse, so date pickers and bookmarked links work correctly everywhere.
• Deleting a site cleans up all data. Orphaned analytics events are now removed automatically before the site is deleted.
• App switcher and site icons load correctly. Logos and favicons were blocked by a security policy. Fixed by allowing images from Ciphera and Google's favicon service.
• Current session highlighted in settings. The active session marker now works correctly.
• Notifications load on sign-in. The notification bell no longer errors briefly after signing in.
• Duplicate filters no longer stack. Clicking the same item twice no longer adds the same filter again.
• Campaigns respect active filters. The Campaigns panel now filters along with everything else instead of always showing all campaigns.
• No duplicate "Direct" in referrer filter. The referrer suggestions no longer show "Direct" twice.
• Filter dropdowns show all your data. Previously limited to 10 items — now loads up to 100 values.
• Chart Y-axis shows whole numbers. Visitor and pageview counts no longer show fractional values like "0.75 visitors".
• Duplicate goal names detected reliably. Goal name uniqueness checks now work correctly regardless of your setup.
• Health checks stay accurate. The backend health check no longer falsely reports the service as unhealthy after sustained traffic.

Added

• Automated testing for improved reliability. Pulse now has a comprehensive test suite that verifies critical parts of the app work correctly before every release. This covers login and session protection, error tracking, online/offline detection, and background data refreshing. These checks run automatically so regressions are caught before they reach you.
• App Switcher in User Menu. Click your profile in the top right and you'll now see a "Ciphera Apps" section. Expand it to quickly jump between Pulse, Drop (file sharing), and your Ciphera Account settings. This makes it easier to discover and navigate between Ciphera products without signing in again.
• Session synchronization across tabs. When you sign out in one browser tab, you're now automatically signed out in all other tabs of the same app. This prevents situations where you might still appear signed in on another tab after logging out. The same applies to signing in — when you sign in on one tab, other tabs will update to reflect your authenticated state.
• Session expiration warning. You'll now see a heads-up banner 3 minutes before your session expires, giving you time to click "Stay signed in" to extend your session. If you ignore it or dismiss it, your session will end naturally after the 15-minute timeout for security. If you interact with the app (click, type, scroll) while the warning is showing, it automatically extends your session.
• Faster billing page loading. Your subscription details now load much quicker when you visit the billing page. Previously, several requests to our payment provider were made one after another, which could add 1-2 seconds to the page load. Now these happen simultaneously, cutting the wait time significantly. If any request takes too long, we gracefully continue so you always see your billing information without frustrating delays.
• Faster funnel analysis for multi-step conversions. We've significantly improved how conversion funnels are calculated. Instead of scanning your data multiple times for each step in a funnel, we now do it in a single efficient pass. This means complex funnels with multiple steps load almost instantly instead of taking seconds—or even timing out. We've also added a reasonable limit of 5 steps per funnel to ensure optimal performance.
• More reliable database connections under heavy load. We've optimized how Pulse manages its database connections to handle much higher traffic without issues. By increasing the connection pool size and improving how connections are reused, your dashboard stays responsive even when thousands of users are viewing analytics simultaneously. We also added better monitoring so we can detect and address connection issues before they affect you.
• Better support for growing teams and traffic. We've added infrastructure improvements that allow Pulse to run smoothly across multiple servers. When you scale up to handle more traffic, our background processes—like daily analytics calculations and data cleanup—will coordinate automatically so they don't conflict with each other. This ensures reliable performance as your team and data grow.
• Smarter protection for heavy dashboard operations. We've implemented a new tiered rate limiting system that treats complex dashboard queries differently from simple requests. Expensive operations—like loading your full dashboard with all its charts and data—now have their own dedicated limits to prevent anyone from accidentally overwhelming the system with too many rapid refreshes. This keeps everything running smoothly for everyone, especially during busy periods.
• Smarter caching for faster dashboard loading. We've added intelligent caching headers to our API responses, so your browser can remember recently loaded data and show it instantly when you navigate between pages. This works alongside our existing server-side caching to make your dashboard feel even more responsive—especially when switching between different date ranges or sections.
• More flexible uptime monitoring. We've made our uptime checker more adaptable to different needs. Instead of a fixed limit on how many websites we can check simultaneously, you can now configure this based on your requirements. This means faster uptime checks for busy sites with many monitors, while keeping things efficient for smaller setups.
• Smarter data cleanup for better performance. We've improved how old analytics data is cleaned up to keep everything running smoothly. Instead of deleting large amounts of data all at once—which could slow things down—we now remove old data in small, efficient batches. This ensures your dashboard stays fast and responsive even as we clean up months of historical data behind the scenes.
• Faster analytics processing for all sites. We've upgraded how your daily analytics are calculated behind the scenes. Instead of processing sites one by one, we now analyze multiple sites simultaneously using a smart parallel system. This means your daily stats—like visitor counts and page views—are updated more quickly and consistently, even as we handle data from thousands of websites.
• Lighter dashboard data transfers. Your dashboard now loads data in smaller, focused pieces instead of one massive bundle. This means faster loading times—especially on slower connections—and your analytics appear section by section as they become ready, rather than making you wait for everything at once.
• Smarter data fetching. Your dashboard now automatically prevents duplicate requests when multiple components ask for the same data at the same time. It also briefly caches recent responses, so switching between pages feels instant while still keeping everything up to date. This reduces server load and makes the app feel snappier.
• Smarter dashboard updates. Your dashboard now knows when you're actively viewing it versus when it's in the background. When you switch to another tab, we intelligently slow down data refreshes to save resources, then instantly catch up when you return. This keeps your analytics current without putting unnecessary load on the system.
• Instant real-time visitor counts. Your dashboard's "current visitors" counter now updates lightning-fast using an optimized tracking system. Instead of scanning your entire database, we maintain a live session index that shows active visitors in milliseconds—even when thousands of people are browsing your sites simultaneously.
• Faster event tracking. Your analytics data is now captured instantly without slowing down your website. We've switched to asynchronous processing that collects events in batches of 100, so your visitors' page views and interactions are recorded with zero impact on their browsing experience, even during traffic spikes.
• Faster dashboard loading. Your site analytics now load almost instantly, even during busy periods. Behind the scenes, we've added intelligent caching that remembers your dashboard data for 30 seconds and refreshes it automatically in the background. Real-time visitor counts are updated every 5 seconds so you always see current activity without waiting.
• Better data management for long-term performance. We've restructured how your analytics data is stored so the app stays fast even as you collect months of data. Old data is now automatically organized by month and cleaned up efficiently based on your retention settings, keeping everything running smoothly no matter how much traffic you get.
• Smarter database indexing. We've optimized how your analytics data is indexed, making common queries—like loading your dashboard or filtering by date—significantly faster. This also reduces storage overhead, keeping the app lean as your data grows.
• Faster dashboard statistics. Loading stats for any date range is now much quicker. Instead of recalculating from scratch every time, we use pre-computed daily summaries so your analytics appear instantly, even for months of data.
• **Performance insights. Track how fast your site loads with Core Web Vitals (page load speed, layout shifts, responsiveness). Turn it on in Site Settings → Data & Privacy to see a performance widget on your dashboard.
• Goals & Events. Define custom goals (e.g. signup, purchase) and track them with pulse.track() in your snippet. Counts appear on your dashboard once you add goals in Site Settings → Goals & Events.
• 2FA recovery codes backup. When you enable 2FA, you receive recovery codes. You can now regenerate new codes (with password confirmation) from Settings and download them as a .txt file. Regenerating invalidates all existing codes.

Changed

• Request ID tracing for debugging. All API requests now include a unique Request ID header (X-Request-ID) that helps trace requests across frontend and backend services. When errors occur, the Request ID is included in the response, making it easy to find the exact request in server logs for debugging.
• App Switcher now shows consistent order. The Ciphera Apps menu now always displays apps in the same order: Pulse, Drop, Auth — regardless of which app you're currently using. Previously, the current app was shown first, causing the order to change depending on context. This creates a more predictable navigation experience.

Fixed

• Shopify and embedded site tracking. The Pulse tracking script now loads correctly when embedded on third-party sites like Shopify stores, WooCommerce, or custom storefronts. Previously, tracking failed because the script was redirected to the login page instead of loading.
• Opening Pulse from the Ciphera hub. Clicking Pulse on the ID apps page (id.ciphera.net/apps) now signs you in correctly instead of showing "Invalid state". Previously, leftover OAuth data from a past login attempt could block the session flow; the callback now detects redirects from the hub (no state in the URL), clears stale PKCE storage, and completes token exchange.
• Admin organizations list. Organizations that created a site but never subscribed now appear in the admin list. Previously only orgs with a billing row were shown.
• Sign in after inactivity. Clicking "Sign in" after a period of inactivity no longer does nothing. Previously, stale refresh cookies caused the middleware to redirect away from the login page; now only a valid access token triggers that redirect, so you can complete OAuth sign-in when your session has expired.
• Frequent re-login. You no longer have to sign in multiple times a day. When the access token expires after 15 minutes of inactivity, the app now automatically refreshes it using your refresh token on the next page load, so you stay logged in for up to 30 days.
• 2FA disable now requires password confirmation. Disabling 2FA sends the derived password to the backend for verification. This prevents an attacker with a hijacked session from stripping 2FA.
• More accurate visitor tracking. We fixed rare edge cases where visitor counts could be slightly off during busy traffic spikes. Previously, the timestamp-based session ID generation could occasionally create overlapping identifiers. Every visitor now gets a truly unique UUID that never overlaps with others, ensuring your analytics are always precise.
• More reliable background processing. When multiple Pulse servers are running, background tasks like daily analytics calculations and data cleanup now coordinate more safely. Previously, under rare timing conditions, two servers could accidentally run the same task at the same time, which could lead to slightly inaccurate stats. Each server now holds a unique token that prevents one from interfering with another's work.
• Cross-tab sign-out cleanup. Signing out in one tab now fully clears your session data in all other tabs. Previously, some session-related entries were left behind, which could briefly show stale state before the redirect completed.
• Settings sidebar highlight. The "Manage Account" section in Settings now stays highlighted when you're viewing Trusted Devices or Security Activity. Previously, navigating to a sub-page removed the highlight from the parent section, making it unclear which group you were in.
• More accurate readiness checks. The service health endpoint now actively verifies that the cache and real-time tracker are reachable, not just configured. Previously, the readiness check only confirmed these services were set up—not that they were actually responding—so the API could report "ready" even when Redis or the tracker was down.

Changed

• Safer sign-in from the Ciphera hub. When you open Pulse from the Ciphera Apps page, your credentials are no longer visible in the browser address bar. Sign-in now uses a secure one-time code that expires in seconds, so your session stays private even if someone sees your screen or browser history.

Added

• Better page titles. Browser tabs now show which site and page you're on (e.g. "Uptime · example.com | Pulse") instead of the same generic title everywhere.
• Link previews for public dashboards. Sharing a public dashboard link on social media now shows a proper preview with the site name and description.
• Faster login redirects. If you're not signed in and try to open a dashboard or settings page, you're redirected to login immediately instead of seeing a blank page first. Already-signed-in users who visit the login page are sent straight to the dashboard.
• Graceful error recovery. If a page crashes, you now see a friendly error screen with a "Try again" button instead of a blank white page. Each section of the app has its own error message so you know exactly what went wrong.
• Security headers. All pages now include clickjacking protection, MIME-sniffing prevention, a strict referrer policy, and HSTS. Browser APIs like camera and microphone are explicitly disabled.
• Better form experience. Forms now auto-focus the first field when they open, text inputs enforce character limits with a visible counter when you're close, and the settings page warns you before navigating away with unsaved changes.
• Accessibility improvements. The notification bell, workspace switcher, and all dashboard tabs are now fully keyboard-navigable. Screen readers announce unread counts, active organizations, and tab changes correctly. Decorative icons are hidden from assistive technology.
• Smooth organization switching. Switching between organizations now shows a branded loading screen instead of a blank flash while the page reloads.
• Graceful server shutdown. Deployments no longer kill in-flight requests or interrupt background tasks. The server finishes ongoing work before shutting down, so your active sessions aren't cut off mid-action.
• Database connection pooling. The backend now limits and recycles database connections, preventing exhaustion under load and keeping queries fast even with many concurrent users.
• Date range validation. Analytics, funnel, and uptime queries now reject invalid date ranges (end before start, or spans longer than a year) and show a clear error instead of empty or confusing results.
• Excluded paths limit. Sites can now have up to 50 excluded paths. Previously there was no cap, which could slow down event processing; the limit keeps things fast while still giving you flexibility.

Changed

• Smoother loading experience. Pages now show a subtle preview of the layout while data loads instead of a blank screen or spinner. This applies everywhere — dashboards, settings, uptime, funnels, notifications, billing, and detail modals.
• Clearer error messages. When something goes wrong, the error message now tells you what failed (e.g. "Failed to load uptime monitors") instead of a generic "Failed to load data".
• Faster favicon loading. Site icons in the dashboard, referrers, and campaigns now use Next.js image optimization for better caching and lazy loading.
• Tighter name limits. Site, funnel, and monitor names are now capped at 100 characters instead of 255 — long enough for any real name, short enough to not break the UI.
• Stricter type safety. Eliminated all any types and @ts-ignore suppressions across the codebase, so the TypeScript compiler catches more bugs at build time and fewer edge cases slip through.
• Smaller page downloads. Icon imports are now tree-shaken so only the icons actually used are included in the bundle, reducing download size and speeding up page loads.
• Removed debug logs. Auth and organization-switching details no longer leak into the browser console in production. Error logs are now also suppressed in production and only appear during development.

Fixed

• Landing page dashboard preview. The homepage now shows a realistic preview of the Pulse dashboard instead of an empty placeholder.
• Logout redirect loop. Signing out no longer bounces you straight to Ciphera ID. You now land on the Pulse homepage where you can choose to sign back in.
• No more loading flicker. Fast-loading pages no longer flash a loading state for a split second before showing content.
• Organization context switch. Switching away from a deleted organization now stores the session correctly instead of using an insecure fallback.
• Dark mode uptime chart. The response time chart on the uptime page now correctly follows your dark mode preference instead of always showing a white tooltip background.
• Onboarding form limits. The welcome page now enforces the same character limits as the rest of the app.
• Audit log reliability. Failed audit log writes are now logged to the server instead of being silently ignored, so gaps in the audit trail are detectable.
• Safer error messages. Server errors no longer expose internal details (database errors, stack traces) to the browser. You see a clear message like "Failed to create site" while the full error is logged server-side for debugging.
• Content Security Policy. The backend CSP header was being overwritten by a duplicate, and the captcha service was incorrectly whitelisted under image sources instead of connection sources. Both are now fixed.
• Logout redirect loop. Signing out no longer bounces you straight to Ciphera ID. You now land on the Pulse homepage where you can choose to sign back in.
• Date range edge case. The maximum date range check could be off by a day due to an internal time adjustment. It now compares calendar days accurately.

Changed

• Design consistency (PULSE-59). Pulse now feels more cohesive across all pages — headings, buttons, and layout are consistent.
• Headings. Marketing and integration pages use the same heading sizes for a clearer visual hierarchy.
• Buttons. Settings pages and the verification modal use consistent button styles. The Enterprise "Contact us" button on pricing now matches the rest.
• Settings layout. Profile settings, Organization Settings, and Site Settings now span the full width of the page, matching the dashboard.
• Charts and maps. Analytics charts, funnel views, and the uptime map now use Pulse's brand colors correctly in both light and dark mode.
• Integration guides. Code examples in the integration and installation guides look cleaner and work better in dark mode.
• Dark mode. Text and backgrounds across settings, pricing, and funnels are easier to read when you switch themes.
• Cards and panels. All cards use consistent padding for a more even layout.
• Integration pages. Integration setup guides have more comfortable spacing at the top.
• Org slug. The organization URL prefix correctly shows pulse.ciphera.net/ instead of the wrong domain.

Added

• Data retention settings (PULSE-58). Site owners can choose how long raw event data is kept (1 month to 3 years depending on plan). Events older than the retention period are automatically deleted every 24 hours. Aggregated daily stats are preserved so historical charts remain intact.
• Data Retention section in Site Settings. Under Data & Privacy, a dropdown lets you set retention; options are capped by your plan (free: up to 6 months, solo: 1 year, team: 2 years, business: 3 years).
• Privacy snippet includes retention. The generated privacy policy text now mentions when raw data is automatically deleted.

Added

• Renewal date and amount. The dashboard and billing tab now show when your subscription renews and how much you'll be charged.
• Invoice preview when changing plans. Before you switch plans, you can see exactly what your next invoice will be (including prorations).
• Pay now for open invoices. Unpaid invoices show a clear "Pay now" button so you can settle them quickly.
• Enterprise contact. The pricing page Enterprise plan now links to email us directly instead of checkout.
• Past due alert. If your payment fails, a red banner appears with a link to update your payment method.
• Pageview usage bar. Your billing card shows a color-coded bar so you can see at a glance how close you are to your limit (green, then amber, then red).

Changed

• Change plan flow. Cleaner plan selector with Solo, Team, and Business options. Shows which plan you're on and a preview of your next invoice. If the preview can't be calculated, you'll see a friendly message instead of a blank screen.
• Billing tab layout. Improved spacing, clearer headings, and better focus when using keyboard navigation.
• Pricing page layout. Updated spacing and typography. Slider and billing toggle are more accessible.
• Billing Portal return. After updating your payment method in Stripe's portal, you're taken back to the billing tab instead of the general settings page.

Fixed

• Theme toggle crash. Fixed a crash that could occur when switching between light and dark mode on the pricing page and then opening organization settings.

Changed

• ciphera-ui consolidation. Migrated shared components and utilities to @ciphera-net/ui (v0.0.57): SwissFlagIcon, CodeBlock, Spinner, format utilities (formatNumber, formatDuration, formatDate, getDateRange, formatUpdatedAgo, formatRelativeTime), and auth error utilities (getAuthErrorMessage, authMessageFromStatus, authMessageFromErrorType). Removed 6 local duplicate files (LoadingOverlay, SwissFlagIcon, CodeBlock, authErrors.ts, format.ts).
• Form card border radius. Login, signup, invite accept, verify, reset-password, forgot-password, and organization create cards now use rounded-2xl to match design system.
• Hardcoded brand colors. Uptime page chart uses CSS variable var(--color-brand-orange) instead of #FD5E0F.
• Selection styling. Removed redundant selection:bg-brand-orange/20 from page wrappers; relies on ciphera-ui base styles.
• Inline spinners. Dashboard widgets (TopReferrers, Locations, TechSpecs, Campaigns, ContentStats), notifications page, and OrganizationSettings now use Spinner from ciphera-ui.
• Footer layout. Authenticated footer container aligned to max-w-6xl (matches site dashboard and page-container-app).

Removed

• Dead components. LoadingOverlay.tsx (unused; all usage already from ciphera-ui).

Added

• Notification settings. New Notifications tab in organization settings lets owners and admins toggle billing and uptime notification categories. Disabling a category stops new notifications of that type from being created.
• In-app notification center. Bell icon in the header with dropdown of recent notifications. Uptime monitor status changes (down, degraded, recovered) create in-app notifications with links to the uptime page.
• Notifications UX improvements. Bell dropdown links to "Manage settings" and "View all" notifications page. Unread count polls every 90 seconds. Full notifications page at /notifications with pagination.
• Notifications tab visibility. Notifications tab in organization settings is hidden from members (owners and admins only).
• Audit log for notification settings. Changes to notification preferences are recorded in the organization audit log.
• Payment failed notifications. When Stripe sends invoice.payment_failed, owners and admins receive an in-app notification with a link to update payment method. Members do not see billing notifications.
• Pageview limit notifications. Owners and admins are notified when usage reaches 80%, 90%, or 100% of the plan limit (checked every 6 hours).
• Trial ending soon. When a trial ends within 7 days, owners and admins receive a notification. Triggered by Stripe webhooks and a periodic checker.
• Subscription canceled. When a subscription is canceled, owners and admins are notified with a link to billing.

Changed

• Top Referrers: X icon instead of Twitter bird. Referrers from x.com and t.co now show the X logo instead of the legacy bird.

Added

• Live chart and KPIs. Chart and stats refresh every 30 seconds. "Live · Xs ago" indicator with green dot in the chart corner counts in real time.
• Polling indicator. Shows when data was last updated (bottom-right of chart card).

Changed

• Analytics chart improvements. Clearer labels, compare mode shows which period you're comparing against, mini trend lines on each stat, export chart as image, and a better experience on mobile.
• Trend context for all date ranges. "vs yesterday" or "vs previous 7 days" now shows for Today, 7 days, and 30 days.
• Compare label shortened. "Compare with previous period" → "Compare".
• Chart axes layout. Y-axis space matches X-axis; metric label moved above chart; compact duration format for axis ticks.

Changed

• Campaigns block improvements (PULSE-53). Sortable columns, favicons and friendly names for sources, pageviews column, and export to CSV. Full dashboard export now includes campaigns.

Changed

• Top Referrers favicons and names (PULSE-52). Real favicons (Google, ChatGPT, etc.) and friendly names instead of raw URLs. Same referrer from different URLs is merged into one row.

Added

• Smarter unique visitor counts. Visitors opening several tabs/windows are counted as one person.
• Visitor count options. Choose "one per tab" (more private) or "one per person" (default). Dashboard shows the right embed snippet for each.

Added

• Initial changelog and release process.