Tracking ID and required domain
Each enabled site has a publictracking_id and required production domain. The domain allows that hostname and its subdomains. Analytics does not use the project API key.
Browser tag and allowed attributes
Browser payload and event APIs
Collector endpoint, limits, and validation
The collector rejects missing tracking IDs, inactive/unknown sites, missing domains, disallowed hosts, excluded traffic, failed subscription access, and applicable rate limits.
Cookies, identity, and attribution
aiola_visitor_id lasts 365 days; aiola_session_id has a sliding 30-minute expiry. Both use path=/, SameSite=Lax, and Secure on HTTPS. Visitor identity also falls back to local storage. Visitor geography is available only when events reach the aiola.app gateway directly; a customer proxy hides the original connection.
Exclusions and Attack Mode
IP, path, country, and hostname exclusion lists are each capped at 50 entries. Paths support exact values or a trailing*; host exclusions include subdomains. Attack Mode applies the stricter collector rules above.
Bot/crawler endpoint and current classification
Only known crawler UAs are stored and the host must match the configured domain. Kinds map to dashboard buckets:
fetch → Answers; search and classic index → Indexing; crawl → Training; ads, social, and remaining kinds → Other.
Dashboard Traffic view
Traffic shows views, visitors, sessions, bounce rate, session time, realtime, pages, entry/exit pages, titles, channels, referrers, campaigns/UTMs, geography, browser/OS/device/screen/language, events, session timelines, revenue, heatmap, and search health.Dashboard AI view and visibility-score definition
AI shows crawl totals, bots, pages, timeseries, the four buckets, AI-answer referrals, uncrawled popular pages, crawler 404s, and discovery-file health. The deterministic 0–100 visibility score combines popular-page crawl coverage, crawler breadth, AI-referral visitors, assistant breadth, androbots.txt/llms.txt/sitemap health.
Goals, funnels, journeys, realtime, and retention
Goals are browser-local on the device. Saved funnels are project definitions. Journeys and realtime use collected sessions/events. Retention is available through the analytics MCP pipe rather than a dashboard panel.Search integrations
Google Search Console and Bing Webmaster connections are account-level; each site maps one property/site in Settings → Analytics → Search Keywords. Provider URLs are capped at 500 characters. Search Console data is delayed about 48 hours.Stripe/manual revenue
Stripe is connected per site. Checkout Sessions must carryaiola_visitor_id and aiola_session_id metadata. Manual revenue uses:
Export/import/clear/disable controls
Export returns at most 100,000 rows. Imports accept at most 10 MiB, 100,000 source rows, and 500,000 expanded events. Clear permanently removes site analytics; disable stops collection while preserving existing data.Setup Health
Setup Health detects a missing tag, tracking-ID mismatch, and collector proxying. Proxying the script can bypass blockers; proxying collection loses trustworthy visitor geography.Central Analytics aggregation semantics
Central sums site-level unique visitor/session counts across visible sites; it does not deduplicate one person across sites. It is an aggregate presentation, not another collector.MCP tools and AI analysis
The workspace exposesget_analytics_overview, get_analytics, get_analytics_definitions, get_search_keywords, and get_indexing_issues. Analyze with AI opens a scoped reporting thread; analytics_retention supplies cohort retention.
Usage/quota behavior, with verified rejection semantics
Billable events are pageviews and custom events (event_type 1 or 2), excluding _leave, _identify, and _scroll. Monthly-quota overages are never rejected: enforcement is dashboard-side, so collection and storage continue and upgrading unlocks the analytics. When subscription access fails because the owner has neither a Pro plan nor an active trial, browser and bot collectors return 402 and do not store the event.