Analytics disclosure
Varve measures only a few aggregate product and website questions. Unknown consent fails closed, and no autocapture, session replay, cookie, or fingerprint is used. The Plausible loader is injected only after consent, with its automatic capture features disabled.
Website events
| Event | Fields | Purpose | Status |
|---|---|---|---|
| website_page_viewed | normalized route | Understand which documentation and product pages are useful. | emitted |
| website_download_started | release, platform, architecture, package type, release channel | Measure the download funnel and platform demand. | emitted |
| website_outbound_clicked | destination category | Understand whether GitHub, documentation, or community links help visitors. | emitted |
| website_contact_clicked | channel category | Understand which support/contact channels are used. | emitted |
Desktop events
Desktop events attribute to the pseudo-page varve.studio/app so they never mix with website pageviews. A periodic flush timer and a beforeunload handler ensure events reach the provider even if the app shuts down.
| Event | Fields | Purpose | Status |
|---|---|---|---|
| app_launched | surface | Count opted-in product sessions. | emitted |
| document_created | blank, template, or import source | Understand activation without seeing the document. | emitted |
| feature_used | closed feature category | Prioritize features with meaningful adoption. | emitted (high-signal subset) |
| export_completed / export_failed | format and coarse duration or error category | Find export reliability and performance problems. | emitted |
| renderer_fallback | from, to, reason | Find platform-specific renderer fallback issues. | emitted |
| browser_demo_launched | entry source | Count demo sessions from the website. | emitted |
| browser_demo_desktop_download | release, platform, architecture, package type | Measure demo-to-desktop conversion. | emitted |
Never collected
Documents, canvas pixels, screenshots, exported artwork, clipboard data, filenames, paths, project or layer names, user text, comments, URLs from designs, imported metadata, image hashes, geometry, generated code, AI prompts, raw exception strings, raw stacks, device identifiers, authentication identities, advertising identifiers, and arbitrary payload fields are prohibited by the schema and runtime privacy boundary.
Consent and transport
Website consent is separate from desktop usage analytics, diagnostics telemetry, and crash reporting. The client uses a bounded in-memory queue, never blocks editing or navigation, and discards pending events when consent is revoked or the process ends. The production deployment is configured for the aggregate Plausible site at varve.studio; local and unconfigured builds remain endpoint-free.