Module: analytics and revenue attribution

The template ships DataFast wired and inert: with no variables set, no script is rendered, nothing is reported, and every page works. Set the three variables in site/.env.example and it switches on.

The chain, and why it has four links

Knowing that a visit happened is easy. Knowing which visit paid is the thing worth having, and the payment completes on the provider's domain, over a webhook, with no page of ours open. So attribution is a chain:

1. The browser script sets a first-party datafast_visitor_id cookie (site/components/Analytics.tsx — the cookie build, deliberately, not the cookieless one, which sets no cookie and breaks every later link).
2. The buy button reads it (visitorId()) and site/app/buy/route.ts passes it to checkout as metadata[datafast_visitor_id].
3. The provider hands the metadata back on checkout.completed.
4. The webhook reports the payment with that visitor id (reportPayment() in site/lib/analytics/server.ts), keyed by order id so a retry is a no-op.

Break any link and every sale reports as direct traffic while the dashboard looks perfectly healthy. DATAFAST_API_KEY missing is the quietest break: the report no-ops and logs, by design — analytics must never fail a webhook.

Consent

The cookie is analytics, so it needs a consent answer in the EU. The privacy page already discloses exactly that one cookie and what it is for. Add a banner if your audience needs one; do not switch to the cookieless build to avoid it without knowing that it ends attribution.

Removing it

The chain crosses several files, so it is not a single rm:

• delete site/components/Analytics.tsx and site/lib/analytics/, and the <Analytics /> element and import in site/app/layout.tsx;
• remove the reportPayment / reportRefund effects from site/app/api/webhooks/[provider]/route.ts;
• remove the readVisitorId call from site/app/buy/route.ts, and the visitorId / trackEvent uses from site/components/BuyButton.tsx and site/components/CtaLink.tsx;
• remove the AI-crawler tracker from proxy.ts, and the three variables from site/.env.example;
• rewrite the analytics paragraphs of site/app/privacy/page.tsx.

Then pnpm verify: if it passes, the removal was complete. The buy flow keeps working; it just stops telling you which visit paid.