Bump to 1.22.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,23 @@ and this project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.22.0] - 2026-10-19
+
+### Added
+
+- Registration funnel stats (first-party, no third-party analytics), showing where people drop off between seeing an event and paying.
+  - A new cookie notice asks visitors once. Only those who choose "Allow" are counted, using a random anonymous visit id.
+  - We record the event page view and the start of registration. The submit and paid stages come from the registration itself.
+  - Only the stage, the traffic source and the device type are stored. No name, IP address or User-Agent is kept.
+- New report, **Registration funnel**: counts and conversion % per stage over a date range, a daily trend, and breakdowns by traffic source, device and ticket option.
+  - Selecting several events compares them.
+  - Sources come from `utm_source` links and from short links, which now add `?src=<alias>` when redirecting.
+- A "Conversion (past month)" tile on the supervisor and admin dashboards covers live events.
+- Raw visit records are rolled up into daily totals after 90 days by a daily job (`ANALYTICS_ROLLUP_ENABLED=false` to turn it off).
+- The privacy policy's cookies section now describes these statistics.
+- New `/api/analytics` endpoints.
+  - Requires the `add_funnel_analytics` database migration.
+
 ## [1.21.0] - 2026-10-19
 
 ### Added

FEATURES.md

@@ -171,6 +171,17 @@ Items & Pricing → Sections → Form → Visibility → Attachments**.
   Each payment records **who recorded it** as well as who it's for.
 - **Refunds** — negative payments against an original payment, netted against
   the original method.
+- **Registration funnel stats** — first-party and consent-based, with no third-party analytics.
+  - A cookie notice asks once. Only visitors who allow it get a random visit id.
+  - We record event page views and registration starts. Submits and payments come
+    from the registration itself.
+  - Each record holds only the stage, the traffic source (utm_source, or the short-link
+    alias, which short links now pass as `?src=`) and the device type.
+  - The Registration funnel report shows counts and conversion per stage over a date
+    range, a daily trend, and breakdowns by source, device and ticket option.
+  - A "Conversion (past month)" tile on the supervisor/admin dashboards covers live
+    events.
+  - Raw rows are rolled up into daily totals after 90 days.
 - **Post-event feedback** — a Feedback step in the event wizard.
   - Questions use the form builder, with new **star rating (1–5)** and **multiple
     choice** types (also available on attendee forms).
@@ -404,7 +415,7 @@ a viewer with its own filters, stat tiles and bar charts.
 | Category | Reports |
 |----------|---------|
 | Financial | Payments between dates · Revenue summary (by method) · Revenue detailed · Finance report (revenue & costs, after discounts) · Profit report · Discounts (coupon codes) |
-| Registration | Attendees per event (grouped by option) · Registration type counts · Master orders breakdown · Registration status breakdown (count by registration or ticket quantity) · Parental consent status · Medical & emergency list · Feedback summary (response rate, average ratings, choice breakdowns, comments; compare events) |
+| Registration | Registration funnel (views → started → submitted → paid, daily trend, by source / device / ticket option) · Attendees per event (grouped by option) · Registration type counts · Master orders breakdown · Registration status breakdown (count by registration or ticket quantity) · Parental consent status · Medical & emergency list · Feedback summary (response rate, average ratings, choice breakdowns, comments; compare events) |
 | Ticketing | Ticket usage summary |
 | Donations | Donations breakdown (used / unused per event, plus the sponsorship pool) |
 | Cashup | Cashup reconciliation · Cashup audit trail |
@@ -477,6 +488,7 @@ falling back to a general guide.
 | Scheduled email/WhatsApp worker | Polls every 30 s (`SCHEDULED_EMAILS_INTERVAL_MS`) and purges sent jobs after 24 h |
 | Daily event summary email | 07:00 daily |
 | Waitlist: expire unclaimed offers, offer freed places | Every 10 minutes (`WAITLIST_JOB_ENABLED=false` to disable) |
+| Funnel analytics: roll raw visit rows older than 90 days into daily totals | Daily (`ANALYTICS_ROLLUP_ENABLED=false` to disable) |
 | Post-event feedback forms and their 3-day reminder | Every 15 minutes (`FEEDBACK_JOB_ENABLED=false` to disable) |
 | Parental consent reminders, and deleting medical details after events | 09:00 daily (`CONSENT_JOBS_ENABLED=false` to disable) |
 | Database backup (`pg_dump`, gzipped, 14-day retention) | 02:00 daily (`BACKUP_ENABLED=false` to disable) |

backend/API_DOCUMENTATION.md

@@ -26,6 +26,7 @@ Tokens are issued by `POST /api/users/login`.
 - [Rooms & groups](#rooms--groups)
 - [Sponsor a spot](#sponsor-a-spot)
 - [Post-event feedback](#post-event-feedback)
+- [Registration funnel](#registration-funnel)
 - [Payments](#payments)
 - [Tickets](#tickets)
 - [Broadcasts (Email)](#broadcasts-email)
@@ -283,6 +284,22 @@ For unauthenticated (guest) registration on events with `requiresAuth: false`:
 
 ---
 
+## Registration funnel
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| POST | `/api/analytics/track` | public (rate-limited) | `{ sessionId, eventId, stage: 'view'\|'start', source? }` → always `204`. Bots are ignored; device type comes from the User-Agent |
+| GET | `/api/analytics/funnel?eventIds=&from=&to=` | supervisor+ | `{ totals, conversion, trend, bySource, byDevice, byOption, perEvent }` |
+
+How the stages are recorded:
+- `POST /api/registrations` accepts `analyticsSessionId`. It's stored on the registration and records the `submit` stage.
+- `paid` is read from that registration's status.
+- Counts are sessions that reached a stage or a later one.
+
+Data handling:
+- Sessions inactive for 90 days are rolled up into `AnalyticsDaily` by a daily job (`ANALYTICS_ROLLUP_ENABLED`).
+- `/api/stats/overview` now includes `funnel: { views, paid, conversion }` for live events over the past 30 days.
+
 ## Post-event feedback
 
 | Method | Path | Auth | Description |

backend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "event-management-backend",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "event-management-backend",
-      "version": "1.21.0",
+      "version": "1.22.0",
       "hasInstallScript": true,
       "dependencies": {
         "@prisma/client": "^5.4.2",

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "event-management-backend",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "description": "Event Management System Backend",
   "main": "src/index.js",
   "scripts": {

backend/prisma/migrations/20261019180220_add_funnel_analytics/migration.sql

@@ -0,0 +1,47 @@
+-- AlterTable
+ALTER TABLE "Registration" ADD COLUMN     "analyticsSessionId" TEXT;
+
+-- CreateTable
+CREATE TABLE "AnalyticsEvent" (
+    "id" TEXT NOT NULL,
+    "sessionId" TEXT NOT NULL,
+    "eventId" TEXT NOT NULL,
+    "stage" TEXT NOT NULL,
+    "source" TEXT,
+    "device" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "AnalyticsEvent_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "AnalyticsDaily" (
+    "id" TEXT NOT NULL,
+    "eventId" TEXT NOT NULL,
+    "day" DATE NOT NULL,
+    "stage" TEXT NOT NULL,
+    "source" TEXT NOT NULL DEFAULT 'direct',
+    "device" TEXT NOT NULL DEFAULT 'unknown',
+    "sessions" INTEGER NOT NULL DEFAULT 0,
+
+    CONSTRAINT "AnalyticsDaily_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "AnalyticsEvent_eventId_createdAt_idx" ON "AnalyticsEvent"("eventId", "createdAt");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "AnalyticsEvent_sessionId_eventId_stage_key" ON "AnalyticsEvent"("sessionId", "eventId", "stage");
+
+-- CreateIndex
+CREATE INDEX "AnalyticsDaily_eventId_day_idx" ON "AnalyticsDaily"("eventId", "day");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "AnalyticsDaily_eventId_day_stage_source_device_key" ON "AnalyticsDaily"("eventId", "day", "stage", "source", "device");
+
+-- AddForeignKey
+ALTER TABLE "AnalyticsEvent" ADD CONSTRAINT "AnalyticsEvent_eventId_fkey" FOREIGN KEY ("eventId") REFERENCES "Event"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "AnalyticsDaily" ADD CONSTRAINT "AnalyticsDaily_eventId_fkey" FOREIGN KEY ("eventId") REFERENCES "Event"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+

backend/prisma/schema.prisma

@@ -153,6 +153,8 @@ model Event {
   sponsorshipGoalSpots    Int?
   showSponsorshipProgress Boolean           @default(true)
   feedbackForm            FeedbackForm?
+  analyticsEvents         AnalyticsEvent[]
+  analyticsDaily          AnalyticsDaily[]
   allocationSets          AllocationSet[]
   waitlistOfferHours      Int               @default(24)
   waitlistPartialOffers   Boolean           @default(true)
@@ -266,6 +268,7 @@ model Registration {
   discountTotal       Float                @default(0)
   // Where named attendees' tickets go: all to the payer, or each to the attendee.
   ticketDelivery      TicketDelivery       @default(payer)
+  analyticsSessionId String?
   createdAt           DateTime             @default(now())
   updatedAt           DateTime             @updatedAt
   user                User                 @relation(fields: [userId], references: [id], onDelete: Restrict)
@@ -851,6 +854,39 @@ enum TicketDelivery {
 
 // One named person on a group registration, for one main-ticket place. Gets their
 // own quantity-1 ticket and their own attendee form response.
+/// First-party funnel tracking (only after cookie consent): one row per anonymous
+/// session, event and stage ('view' | 'start' | 'submit'). "Paid" comes from the
+/// registration that carries the session id. Rows older than 90 days are rolled up
+/// into AnalyticsDaily and deleted.
+model AnalyticsEvent {
+  id        String   @id @default(uuid())
+  sessionId String
+  eventId   String
+  stage     String
+  source    String?
+  device    String?
+  createdAt DateTime @default(now())
+  event     Event    @relation(fields: [eventId], references: [id], onDelete: Cascade)
+
+  @@unique([sessionId, eventId, stage])
+  @@index([eventId, createdAt])
+}
+
+/// Rolled-up funnel counts: sessions that reached `stage`, per day, source and device.
+model AnalyticsDaily {
+  id       String   @id @default(uuid())
+  eventId  String
+  day      DateTime @db.Date
+  stage    String
+  source   String   @default("direct")
+  device   String   @default("unknown")
+  sessions Int      @default(0)
+  event    Event    @relation(fields: [eventId], references: [id], onDelete: Cascade)
+
+  @@unique([eventId, day, stage, source, device])
+  @@index([eventId, day])
+}
+
 /// Post-event survey. Sent at sendAt to checked-in attendees (or everyone registered),
 /// with one reminder 3 days later. anonymous responses aren't linked to a person.
 model FeedbackForm {

backend/src/controllers/analyticsController.js

@@ -0,0 +1,44 @@
+const prisma = require('../config/db');
+const { safeErrorMessage } = require('../utils/errorUtils');
+const { track, funnelFor } = require('../utils/analytics');
+
+// @desc    Record a funnel step (event page view, registration started)
+// @route   POST /api/analytics/track   { sessionId, eventId, stage: 'view'|'start', source? }
+// @access  Public — only sent by browsers whose visitor accepted cookies
+const trackStage = async (req, res) => {
+  try {
+    const { sessionId, eventId, stage, source } = req.body || {};
+    await track({ sessionId, eventId, stage, source, userAgent: req.headers['user-agent'] });
+  } catch (e) {
+    console.warn('[analytics] track failed:', e?.message || e);
+  }
+  // Always a quiet 204 — tracking must never get in a visitor's way.
+  res.status(204).end();
+};
+
+// @desc    Registration funnel for one or more events
+// @route   GET /api/analytics/funnel?eventIds=a,b&from=YYYY-MM-DD&to=YYYY-MM-DD
+// @access  Private/Supervisor
+const getFunnel = async (req, res) => {
+  try {
+    const eventIds = String(req.query.eventIds || '').split(',').map(s => s.trim()).filter(Boolean).slice(0, 50);
+    if (eventIds.length === 0) { res.status(400); throw new Error('Choose at least one event'); }
+    const events = await prisma.event.findMany({ where: { id: { in: eventIds } }, select: { id: true, title: true } });
+    const total = await funnelFor(eventIds, { from: req.query.from, to: req.query.to });
+    // Per event too, so events can be compared.
+    const perEvent = [];
+    if (events.length > 1) {
+      for (const ev of events) {
+        const f = await funnelFor([ev.id], { from: req.query.from, to: req.query.to });
+        perEvent.push({ eventId: ev.id, title: ev.title, totals: f.totals, conversion: f.conversion });
+      }
+    } else if (events[0]) {
+      perEvent.push({ eventId: events[0].id, title: events[0].title, totals: total.totals, conversion: total.conversion });
+    }
+    res.json({ ...total, perEvent });
+  } catch (error) {
+    res.status(res.statusCode === 200 ? 400 : res.statusCode).json({ message: safeErrorMessage(error) });
+  }
+};
+
+module.exports = { trackStage, getFunnel };

backend/src/controllers/registrationController.js

@@ -110,7 +110,7 @@ async function checkVariantStock(variant, requestedQty, excludeEntryId = null) {
 // @access  Private
 const createRegistration = async (req, res) => {
   try {
-    const { eventId, options, guestName, guestEmail, guestPhone, couponCode, attendees, ticketDelivery, waitlistToken } = req.body;
+    const { eventId, options, guestName, guestEmail, guestPhone, couponCode, attendees, ticketDelivery, waitlistToken, analyticsSessionId } = req.body;
 
     // Check if event exists
     const canIncludeVariants = !!(prisma && prisma.optionVariant && typeof prisma.optionVariant.findMany === 'function');
@@ -503,6 +503,12 @@ const createRegistration = async (req, res) => {
       }
     })();
 
+    // Funnel: this registration came from a tracked (cookie-consented) visit.
+    if (analyticsSessionId) {
+      const { recordSubmit } = require('../utils/analytics');
+      recordSubmit(registration, analyticsSessionId).catch(e => console.warn('[analytics] submit not recorded:', e?.message || e));
+    }
+
     res.status(201).json({ ...attachComputedTotals(registration), ...(couponError ? { couponError } : {}) });
   } catch (error) {
     res.status(400).json({ message: error.message });

backend/src/controllers/statsController.js

@@ -267,7 +267,21 @@ const getOverviewStats = async (req, res) => {
       ticketsSold: ticketSumById[r.eventId] || 0,
     }));
 
+    // Funnel conversion (event page views → paid) across live events, last 30 days.
+    let funnel = null;
+    try {
+      const live = await prisma.event.findMany({ where: { isActive: true, endDate: { gte: now } }, select: { id: true } });
+      if (live.length) {
+        const { funnelFor } = require('../utils/analytics');
+        const f = await funnelFor(live.map(e => e.id), { from: new Date(now.getTime() - 30 * 864e5).toISOString() });
+        if (f.totals.view > 0) funnel = { views: f.totals.view, paid: f.totals.paid, conversion: f.conversion.paid };
+      }
+    } catch (e) {
+      console.warn('[stats] funnel tile failed:', e?.message || e);
+    }
+
     res.json({
+      funnel,
       activeEvents,
       registrations: { thisMonth: thisRegistrations, lastMonth: lastRegistrations, pctChange: pctChange(thisRegistrations, lastRegistrations) },
       ticketsSold: { thisMonth: thisTicketsSold, lastMonth: lastTicketsSold, pctChange: pctChange(thisTicketsSold, lastTicketsSold) },

backend/src/index.js

@@ -182,6 +182,7 @@ app.use('/api/scan-locks', require('./routes/scanLockRoutes'));
 app.use('/api/allocations', require('./routes/allocationRoutes'));
 app.use('/api/sponsorships', require('./routes/sponsorshipRoutes'));
 app.use('/api/feedback', require('./routes/feedbackRoutes'));
+app.use('/api/analytics', require('./routes/analyticsRoutes'));
 app.use('/api/backups', backupRoutes);
 
 // Pre-warm the settings cache so synchronous helpers have DB values from startup
@@ -638,6 +639,11 @@ app.get('/docs', async (req, res) => {
         ]},
     ]},
 
+    { title: 'Registration funnel', base: '/api/analytics', endpoints: [
+      { method:'POST', path:'/api/analytics/track', auth:'Public (rate-limited)', desc:'Record a funnel step from a cookie-consented browser (always 204)',
+        request:{ body:{ sessionId:'random-uuid', eventId:'ev-uuid-...', stage:'view', source:'camp-2025' }}},
+      { method:'GET', path:'/api/analytics/funnel', auth:'supervisor+', desc:'Funnel for ?eventIds=a,b&from=&to= — totals, conversion, daily trend, by source/device/option' },
+    ]},
     { title: 'Post-event feedback', base: '/api/feedback', endpoints: [
       { method:'GET', path:'/api/feedback/event/:eventId', auth:'supervisor+', desc:'An event\'s feedback form, with invite and response counts' },
       { method:'PUT', path:'/api/feedback/event/:eventId', auth:'supervisor+', desc:'Create/update the feedback form (questions lock once answered)',
@@ -1399,6 +1405,29 @@ app.listen(PORT, () => {
     console.warn('[waitlist] Not scheduled:', e?.message || e);
   }
 
+  // Funnel analytics — once a day, roll raw rows older than 90 days into daily totals.
+  try {
+    const enabled = String(process.env.ANALYTICS_ROLLUP_ENABLED || 'true').toLowerCase() !== 'false';
+    if (enabled) {
+      const { rollupOldEvents } = require('./utils/analytics');
+      const run = async () => {
+        try {
+          const n = await rollupOldEvents();
+          if (n) console.log(`[analytics] Rolled up ${n} session(s) older than 90 days.`);
+        } catch (e) {
+          console.warn('[analytics] Rollup failed:', e?.message || e);
+        }
+      };
+      setTimeout(run, 5 * 60 * 1000);
+      setInterval(run, 24 * 60 * 60 * 1000);
+      console.log('[analytics] Rollup daily.');
+    } else {
+      console.log('[analytics] Rollup disabled by env ANALYTICS_ROLLUP_ENABLED=false');
+    }
+  } catch (e) {
+    console.warn('[analytics] Not scheduled:', e?.message || e);
+  }
+
   // Feedback job — send post-event feedback forms at their send time, and the one
   // reminder 3 days later.
   try {

backend/src/routes/analyticsRoutes.js

@@ -0,0 +1,18 @@
+const express = require('express');
+const rateLimit = require('express-rate-limit');
+const router = express.Router();
+const { trackStage, getFunnel } = require('../controllers/analyticsController');
+const { protect, supervisor } = require('../middleware/authMiddleware');
+
+const trackLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 60,
+  standardHeaders: true,
+  legacyHeaders: false,
+  handler: (req, res) => res.status(204).end(), // silently drop floods
+});
+
+router.post('/track', trackLimiter, trackStage);
+router.get('/funnel', protect, supervisor, getFunnel);
+
+module.exports = router;

backend/src/utils/analytics.js

@@ -0,0 +1,220 @@
+/**
+ * Registration funnel — first-party, consent-based tracking.
+ *
+ * The browser only tracks after the visitor accepts cookies: it keeps a random session
+ * id and reports 'view' (event page) and 'start' (registration page). 'submit' is
+ * recorded here when a registration arrives carrying that session id, and 'paid' is
+ * read from that registration's status, so no personal data is stored with the events —
+ * just a stage, a traffic source and a device type (worked out from the User-Agent,
+ * which isn't kept).
+ *
+ * Counts are "reached": a session counts at a stage if it got that far or further, so a
+ * visitor who went straight to the registration page still counts as a view. Raw rows
+ * older than 90 days are rolled up into AnalyticsDaily and deleted.
+ */
+
+const prisma = require('../config/db');
+
+const STAGES = ['view', 'start', 'submit', 'paid'];
+const TRACKED = ['view', 'start'];
+const RAW_DAYS = 90;
+const SESSION_RE = /^[a-zA-Z0-9-]{16,64}$/;
+
+const dayOf = (d) => new Date(d).toISOString().slice(0, 10);
+
+// ─── Pure helpers ─────────────────────────────────────────────────────────────
+
+const validSession = (sid) => typeof sid === 'string' && SESSION_RE.test(sid);
+
+/** 'mobile' | 'tablet' | 'desktop', or null for bots. Pure. */
+function deviceFromUA(ua) {
+  const s = String(ua || '');
+  if (!s || /bot|crawl|spider|slurp|preview|headless|lighthouse/i.test(s)) return null;
+  if (/iPad|Tablet|PlayBook|Silk|(Android(?!.*Mobile))/i.test(s)) return 'tablet';
+  if (/Mobi|iPhone|iPod|Android|Windows Phone/i.test(s)) return 'mobile';
+  return 'desktop';
+}
+
+/** A traffic source label: utm_source / short-link alias, tidied; 'direct' when none. Pure. */
+function cleanSource(src) {
+  const s = String(src || '').trim().toLowerCase().replace(/[^a-z0-9_.-]/g, '').slice(0, 50);
+  return s || 'direct';
+}
+
+/**
+ * One entry per session: the furthest stage reached, its source/device, and the day each
+ * stage was reached. Pure.
+ * @param {Array} events - [{ sessionId, stage, createdAt, source, device }]
+ * @param {Set} paidSessions - session ids whose registration is paid
+ */
+function sessionsFrom(events, paidSessions = new Set()) {
+  const map = new Map();
+  for (const e of [...events].sort((a, b) => new Date(a.createdAt) - new Date(b.createdAt))) {
+    const s = map.get(e.sessionId) || { sessionId: e.sessionId, reach: -1, source: null, device: null, days: {} };
+    const idx = STAGES.indexOf(e.stage);
+    if (idx > s.reach) s.reach = idx;
+    if (!s.days[e.stage]) s.days[e.stage] = dayOf(e.createdAt);
+    if (!s.source && e.source) s.source = e.source;
+    if (!s.device && e.device) s.device = e.device;
+    map.set(e.sessionId, s);
+  }
+  for (const s of map.values()) {
+    if (paidSessions.has(s.sessionId) && s.reach >= 2) { s.reach = 3; s.days.paid = s.days.submit; }
+    // A stage reached without its own event (e.g. no 'view' for a direct link) takes the
+    // day of the next stage that was recorded.
+    for (let i = STAGES.length - 1; i >= 0; i--) {
+      if (i <= s.reach && !s.days[STAGES[i]]) s.days[STAGES[i]] = s.days[STAGES[i + 1]];
+    }
+    s.source = s.source || 'direct';
+    s.device = s.device || 'unknown';
+  }
+  return [...map.values()];
+}
+
+/** Rows for AnalyticsDaily: sessions reaching each stage per day/source/device. Pure. */
+function rollupRows(sessions) {
+  const by = new Map();
+  for (const s of sessions) {
+    for (let i = 0; i <= s.reach; i++) {
+      const key = [s.days[STAGES[i]], STAGES[i], s.source, s.device].join('|');
+      by.set(key, (by.get(key) || 0) + 1);
+    }
+  }
+  return [...by.entries()].map(([key, n]) => {
+    const [day, stage, source, device] = key.split('|');
+    return { day, stage, source, device, sessions: n };
+  });
+}
+
+const emptyCounts = () => ({ view: 0, start: 0, submit: 0, paid: 0 });
+
+/**
+ * The funnel report from raw sessions plus rolled-up rows. Pure.
+ * @returns {{ totals, conversion, trend, bySource, byDevice }}
+ */
+function funnelReport(sessions, daily = []) {
+  const rows = [...rollupRows(sessions), ...daily.map(d => ({ ...d, day: typeof d.day === 'string' ? d.day.slice(0, 10) : dayOf(d.day) }))];
+  const totals = emptyCounts();
+  const trend = new Map(), bySource = new Map(), byDevice = new Map();
+  const add = (map, key, stage, n) => { const c = map.get(key) || emptyCounts(); c[stage] += n; map.set(key, c); };
+  for (const r of rows) {
+    totals[r.stage] += r.sessions;
+    add(trend, r.day, r.stage, r.sessions);
+    add(bySource, r.source, r.stage, r.sessions);
+    add(byDevice, r.device, r.stage, r.sessions);
+  }
+  const pct = (a, b) => (b ? Math.round((a / b) * 1000) / 10 : null);
+  const list = (map) => [...map.entries()].map(([key, c]) => ({ key, ...c, conversion: pct(c.paid, c.view) })).sort((a, b) => b.view - a.view);
+  return {
+    totals,
+    conversion: {
+      start: pct(totals.start, totals.view), submit: pct(totals.submit, totals.view), paid: pct(totals.paid, totals.view),
+      startToSubmit: pct(totals.submit, totals.start), submitToPaid: pct(totals.paid, totals.submit),
+    },
+    trend: [...trend.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([day, c]) => ({ day, ...c })),
+    bySource: list(bySource),
+    byDevice: list(byDevice),
+  };
+}
+
+// ─── Database ─────────────────────────────────────────────────────────────────
+
+/** Records a 'view' or 'start'. Repeats from the same session are ignored. */
+async function track({ sessionId, eventId, stage, source, userAgent }) {
+  if (!validSession(sessionId) || !TRACKED.includes(stage) || typeof eventId !== 'string') return false;
+  const device = deviceFromUA(userAgent);
+  if (!device) return false; // bots
+  const event = await prisma.event.findUnique({ where: { id: eventId }, select: { id: true } });
+  if (!event) return false;
+  await prisma.analyticsEvent.createMany({ data: [{ sessionId, eventId, stage, source: cleanSource(source), device }], skipDuplicates: true });
+  return true;
+}
+
+/** 'submit' for a registration made on the public registration page. */
+async function recordSubmit(registration, sessionId) {
+  if (!validSession(sessionId) || !registration?.id) return;
+  const first = await prisma.analyticsEvent.findFirst({ where: { sessionId, eventId: registration.eventId }, orderBy: { createdAt: 'asc' } });
+  await prisma.registration.updateMany({ where: { id: registration.id, analyticsSessionId: null }, data: { analyticsSessionId: sessionId } });
+  await prisma.analyticsEvent.createMany({
+    data: [{ sessionId, eventId: registration.eventId, stage: 'submit', source: first?.source || 'direct', device: first?.device || null }],
+    skipDuplicates: true,
+  });
+}
+
+async function paidSessionsFor(eventIds, sessionIds) {
+  if (!sessionIds.length) return new Set();
+  const regs = await prisma.registration.findMany({
+    where: { eventId: { in: eventIds }, status: 'paid', analyticsSessionId: { in: sessionIds } },
+    select: { analyticsSessionId: true },
+  });
+  return new Set(regs.map(r => r.analyticsSessionId));
+}
+
+/**
+ * The funnel for some events between two dates (by the day each stage was reached).
+ * Adds a by-ticket-option breakdown from the tracked registrations.
+ */
+async function funnelFor(eventIds, { from, to } = {}) {
+  const range = {};
+  if (from) range.gte = new Date(from);
+  if (to) { const t = new Date(to); t.setHours(23, 59, 59, 999); range.lte = t; }
+  const where = { eventId: { in: eventIds }, ...(from || to ? { createdAt: range } : {}) };
+  const events = await prisma.analyticsEvent.findMany({ where, select: { sessionId: true, stage: true, createdAt: true, source: true, device: true, eventId: true } });
+  // A session is per event (the same browser can look at several events).
+  const keyed = events.map(e => ({ ...e, sessionId: `${e.eventId}:${e.sessionId}` }));
+  const paidRaw = await paidSessionsFor(eventIds, [...new Set(events.map(e => e.sessionId))]);
+  const paid = new Set(events.filter(e => paidRaw.has(e.sessionId)).map(e => `${e.eventId}:${e.sessionId}`));
+  const daily = await prisma.analyticsDaily.findMany({
+    where: { eventId: { in: eventIds }, ...(from || to ? { day: range } : {}) },
+    select: { day: true, stage: true, source: true, device: true, sessions: true },
+  });
+  const report = funnelReport(sessionsFrom(keyed, paid), daily);
+
+  const regs = await prisma.registration.findMany({
+    where: { eventId: { in: eventIds }, analyticsSessionId: { not: null }, status: { not: 'cancelled' }, ...(from || to ? { createdAt: range } : {}) },
+    select: { status: true, registrationOptions: { select: { quantity: true, eventOption: { select: { name: true } }, variant: { select: { name: true } } } } },
+  });
+  const byOption = new Map();
+  for (const r of regs) {
+    for (const ro of r.registrationOptions) {
+      const key = ro.variant ? `${ro.eventOption.name} — ${ro.variant.name}` : ro.eventOption.name;
+      const c = byOption.get(key) || { key, submitted: 0, paid: 0 };
+      c.submitted += 1;
+      if (r.status === 'paid') c.paid += 1;
+      byOption.set(key, c);
+    }
+  }
+  return { ...report, byOption: [...byOption.values()].sort((a, b) => b.submitted - a.submitted) };
+}
+
+/** Rolls up sessions whose last activity is older than 90 days, then deletes their rows. */
+async function rollupOldEvents(now = new Date()) {
+  const cutoff = new Date(now.getTime() - RAW_DAYS * 864e5);
+  const groups = await prisma.analyticsEvent.groupBy({ by: ['eventId', 'sessionId'], _max: { createdAt: true }, having: { createdAt: { _max: { lt: cutoff } } } });
+  if (groups.length === 0) return 0;
+  const byEvent = new Map();
+  for (const g of groups) byEvent.set(g.eventId, [...(byEvent.get(g.eventId) || []), g.sessionId]);
+  let rolled = 0;
+  for (const [eventId, sessionIds] of byEvent) {
+    for (let i = 0; i < sessionIds.length; i += 500) {
+      const batch = sessionIds.slice(i, i + 500);
+      const events = await prisma.analyticsEvent.findMany({ where: { eventId, sessionId: { in: batch } } });
+      const paid = await paidSessionsFor([eventId], batch);
+      const rows = rollupRows(sessionsFrom(events, paid));
+      await prisma.$transaction(async (tx) => {
+        for (const r of rows) {
+          await tx.analyticsDaily.upsert({
+            where: { eventId_day_stage_source_device: { eventId, day: new Date(r.day), stage: r.stage, source: r.source, device: r.device } },
+            update: { sessions: { increment: r.sessions } },
+            create: { eventId, day: new Date(r.day), stage: r.stage, source: r.source, device: r.device, sessions: r.sessions },
+          });
+        }
+        await tx.analyticsEvent.deleteMany({ where: { eventId, sessionId: { in: batch } } });
+      });
+      rolled += batch.length;
+    }
+  }
+  return rolled;
+}
+
+module.exports = { STAGES, RAW_DAYS, validSession, deviceFromUA, cleanSource, sessionsFrom, rollupRows, funnelReport, track, recordSubmit, funnelFor, rollupOldEvents };

backend/tests/analytics.test.js

@@ -0,0 +1,70 @@
+const { deviceFromUA, cleanSource, sessionsFrom, rollupRows, funnelReport } = require('../src/utils/analytics');
+
+const ev = (sessionId, stage, day, extra = {}) => ({ sessionId, stage, createdAt: `${day}T10:00:00Z`, ...extra });
+
+describe('deviceFromUA', () => {
+  test('mobile, tablet, desktop and bots', () => {
+    expect(deviceFromUA('Mozilla/5.0 (iPhone; CPU iPhone OS 17_0) Mobile/15E148')).toBe('mobile');
+    expect(deviceFromUA('Mozilla/5.0 (Linux; Android 14; SM-X200) Safari')).toBe('tablet');
+    expect(deviceFromUA('Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120')).toBe('desktop');
+    expect(deviceFromUA('Googlebot/2.1')).toBeNull();
+    expect(deviceFromUA('')).toBeNull();
+  });
+});
+
+describe('cleanSource', () => {
+  test('tidies, defaulting to direct', () => {
+    expect(cleanSource(' Facebook ')).toBe('facebook');
+    expect(cleanSource('camp-2025<script>')).toBe('camp-2025script');
+    expect(cleanSource('')).toBe('direct');
+  });
+});
+
+describe('sessionsFrom', () => {
+  test('a session counts as having reached every earlier stage', () => {
+    const [s] = sessionsFrom([ev('a', 'start', '2026-01-02')]);
+    expect(s.reach).toBe(1);
+    expect(s.days.view).toBe('2026-01-02');
+  });
+
+  test('paid only counts for sessions that submitted', () => {
+    const out = sessionsFrom([ev('a', 'view', '2026-01-01', { source: 'fb', device: 'mobile' }), ev('a', 'submit', '2026-01-03'), ev('b', 'view', '2026-01-01')], new Set(['a', 'b']));
+    const a = out.find(s => s.sessionId === 'a');
+    expect(a.reach).toBe(3);
+    expect(a.days.paid).toBe('2026-01-03');
+    expect(a.source).toBe('fb');
+    expect(out.find(s => s.sessionId === 'b').reach).toBe(0);
+  });
+});
+
+describe('funnelReport', () => {
+  const sessions = sessionsFrom([
+    ev('a', 'view', '2026-01-01', { source: 'fb', device: 'mobile' }), ev('a', 'start', '2026-01-01'), ev('a', 'submit', '2026-01-01'),
+    ev('b', 'view', '2026-01-01', { source: 'fb', device: 'desktop' }), ev('b', 'start', '2026-01-02'),
+    ev('c', 'view', '2026-01-02', { device: 'mobile' }),
+    ev('d', 'view', '2026-01-02', { device: 'mobile' }),
+  ], new Set(['a']));
+
+  test('counts and conversion per stage', () => {
+    const r = funnelReport(sessions);
+    expect(r.totals).toEqual({ view: 4, start: 2, submit: 1, paid: 1 });
+    expect(r.conversion.start).toBe(50);
+    expect(r.conversion.paid).toBe(25);
+    expect(r.conversion.startToSubmit).toBe(50);
+  });
+
+  test('daily trend and breakdowns', () => {
+    const r = funnelReport(sessions);
+    expect(r.trend).toEqual([{ day: '2026-01-01', view: 2, start: 1, submit: 1, paid: 1 }, { day: '2026-01-02', view: 2, start: 1, submit: 0, paid: 0 }]);
+    expect(r.bySource.find(s => s.key === 'fb')).toMatchObject({ view: 2, paid: 1, conversion: 50 });
+    expect(r.bySource.find(s => s.key === 'direct').view).toBe(2);
+    expect(r.byDevice.find(s => s.key === 'mobile').view).toBe(3);
+  });
+
+  test('rolled-up rows add to the raw counts', () => {
+    const daily = rollupRows(sessionsFrom([ev('x', 'view', '2025-10-01'), ev('x', 'submit', '2025-10-01')], new Set(['x'])));
+    expect(daily.find(r => r.stage === 'paid').sessions).toBe(1);
+    const r = funnelReport(sessions, daily);
+    expect(r.totals).toEqual({ view: 5, start: 3, submit: 2, paid: 2 });
+  });
+});

frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hope-events-frontend",
-      "version": "1.21.0",
+      "version": "1.22.0",
       "dependencies": {
         "@dnd-kit/core": "^6.3.1",
         "@hookform/resolvers": "^5.2.1",

frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "private": true,
   "scripts": {
     "dev": "next dev --turbopack",

frontend/src/app/[redirectUrl]/page.tsx

@@ -40,7 +40,7 @@ export default async function EventRedirectPage({ params }: { params: Promise<{
     }
 
     if (event.isLive || event.isActive) {
-        redirect(`/events/${event.id}`);
+        redirect(`/events/${event.id}?src=${encodeURIComponent(redirectUrl)}`);
     }
 
     return (

frontend/src/app/dashboard/admin/page.tsx

@@ -8,7 +8,7 @@ import { useStableState } from "@/hooks/useStableState";
 import { useVisiblePolling } from "@/hooks/useVisiblePolling";
 import {
   Calendar, Banknote, Gift, Users, Ticket, QrCode, ClipboardList,
-  UserPlus, FileText, MessageCircle, BarChart2, Mail, Wallet, DoorOpen, History, TicketPercent, ShieldCheck, ListChecks, WifiOff, BedDouble,
+  UserPlus, FileText, MessageCircle, BarChart2, Mail, Wallet, DoorOpen, History, TicketPercent, ShieldCheck, ListChecks, WifiOff, BedDouble, Filter,
 } from "lucide-react";
 import { StatCard, StatCardRow } from "@/components/shared/StatCard";
 import { QuickActionTile, QuickActionGrid } from "@/components/shared/QuickActionTile";
@@ -43,6 +43,7 @@ const QUICK_ACTIONS = [
 
 type OverviewMetric = { thisMonth: number; lastMonth: number; pctChange: number | null };
 type Overview = {
+  funnel?: { views: number; paid: number; conversion: number | null } | null;
   activeEvents: number;
   registrations: OverviewMetric;
   ticketsSold: OverviewMetric;
@@ -120,12 +121,15 @@ export default function AdminDashboardPage() {
         </div>
       )}
 
-      <StatCardRow>
+      <StatCardRow cols={overview?.funnel ? 6 : 5}>
         <StatCard icon={Calendar} label="Active events" value={overview ? formatCount(overview.activeEvents) : "—"} tone="brand" href="/dashboard/supervisor/events" linkLabel="View all events" />
         <StatCard icon={Banknote} label="Revenue (past month)" value={overview ? formatRand(overview.revenue.thisMonth) : "—"} tone="green" href={`${REPORTS_URL}?report=revenue&range=trailing_month`} linkLabel="View report" delta={overview ? { value: overview.revenue.pctChange } : undefined} />
         <StatCard icon={Gift} label="Donations (past month)" value={overview ? formatRand(overview.donations.thisMonth) : "—"} tone="rose" href={`${REPORTS_URL}?report=donations&range=trailing_month`} linkLabel="View report" delta={overview ? { value: overview.donations.pctChange } : undefined} />
         <StatCard icon={Users} label="Registrations (past month)" value={overview ? formatCount(overview.registrations.thisMonth) : "—"} tone="blue" href="/dashboard/admin/registrations" linkLabel="View registrations" delta={overview ? { value: overview.registrations.pctChange } : undefined} />
         <StatCard icon={Ticket} label="Tickets sold (past month)" value={overview ? formatCount(overview.ticketsSold.thisMonth) : "—"} tone="amber" href={`${REPORTS_URL}?report=usage&range=trailing_month`} linkLabel="View report" delta={overview ? { value: overview.ticketsSold.pctChange } : undefined} />
+        {overview?.funnel && (
+          <StatCard icon={Filter} label="Conversion (past month)" value={overview.funnel.conversion != null ? `${overview.funnel.conversion}%` : "—"} tone="violet" href={`${REPORTS_URL}?report=funnel&range=trailing_month`} linkLabel={`${overview.funnel.paid} of ${overview.funnel.views} visits`} />
+        )}
       </StatCardRow>
 
       <div className="border rounded-xl p-4 bg-white shadow-sm my-6">

frontend/src/app/dashboard/supervisor/page.tsx

@@ -8,7 +8,7 @@ import { useStableState } from "@/hooks/useStableState";
 import { useVisiblePolling } from "@/hooks/useVisiblePolling";
 import {
   Calendar, Banknote, Gift, Users, Ticket, QrCode, DoorOpen, Wallet,
-  UserPlus, FileText, MessageCircle, BarChart2, Mail, TicketPercent, ShieldCheck, ListChecks, WifiOff, BedDouble,
+  UserPlus, FileText, MessageCircle, BarChart2, Mail, TicketPercent, ShieldCheck, ListChecks, WifiOff, BedDouble, Filter,
 } from "lucide-react";
 import { StatCard, StatCardRow } from "@/components/shared/StatCard";
 import { QuickActionTile, QuickActionGrid } from "@/components/shared/QuickActionTile";
@@ -39,6 +39,7 @@ const QUICK_ACTIONS = [
 
 type OverviewMetric = { thisMonth: number; lastMonth: number; pctChange: number | null };
 type Overview = {
+  funnel?: { views: number; paid: number; conversion: number | null } | null;
   activeEvents: number;
   registrations: OverviewMetric;
   ticketsSold: OverviewMetric;
@@ -118,12 +119,15 @@ export default function SupervisorDashboardPage() {
         </div>
       )}
 
-      <StatCardRow>
+      <StatCardRow cols={overview?.funnel ? 6 : 5}>
         <StatCard icon={Calendar} label="Active events" value={overview ? formatCount(overview.activeEvents) : "—"} tone="brand" href="/dashboard/supervisor/events" linkLabel="View all events" />
         <StatCard icon={Banknote} label="Revenue (past month)" value={overview ? formatRand(overview.revenue.thisMonth) : "—"} tone="green" href={`${REPORTS_URL}?report=revenue&range=trailing_month`} linkLabel="View report" delta={overview ? { value: overview.revenue.pctChange } : undefined} />
         <StatCard icon={Gift} label="Donations (past month)" value={overview ? formatRand(overview.donations.thisMonth) : "—"} tone="rose" href={`${REPORTS_URL}?report=donations&range=trailing_month`} linkLabel="View report" delta={overview ? { value: overview.donations.pctChange } : undefined} />
         <StatCard icon={Users} label="Registrations (past month)" value={overview ? formatCount(overview.registrations.thisMonth) : "—"} tone="blue" href={`${REPORTS_URL}?report=regStatus&range=trailing_month`} linkLabel="View report" delta={overview ? { value: overview.registrations.pctChange } : undefined} />
         <StatCard icon={Ticket} label="Tickets sold (past month)" value={overview ? formatCount(overview.ticketsSold.thisMonth) : "—"} tone="amber" href={`${REPORTS_URL}?report=usage&range=trailing_month`} linkLabel="View report" delta={overview ? { value: overview.ticketsSold.pctChange } : undefined} />
+        {overview?.funnel && (
+          <StatCard icon={Filter} label="Conversion (past month)" value={overview.funnel.conversion != null ? `${overview.funnel.conversion}%` : "—"} tone="violet" href={`${REPORTS_URL}?report=funnel&range=trailing_month`} linkLabel={`${overview.funnel.paid} of ${overview.funnel.views} visits`} />
+        )}
       </StatCardRow>
 
       <div className="border rounded-xl p-4 bg-white shadow-sm my-6">

frontend/src/app/events/[id]/page.tsx

@@ -7,6 +7,7 @@ import { ContactButton } from "@/components/events/ContactButton";
 import { LocationMap } from "@/components/events/LocationMap";
 import { JoinWaitlistButton, soldOutLines } from "@/components/events/JoinWaitlistButton";
 import { SponsorSpot } from "@/components/events/SponsorSpot";
+import { FunnelTracker } from "@/components/events/FunnelTracker";
 import { Calendar, Ticket, Paperclip, Sparkles } from "lucide-react";
 
 export const revalidate = 60;
@@ -166,6 +167,7 @@ export default async function EventDetailPage({ params }: { params: Promise<{ id
     <div className="min-h-screen flex flex-col">
       <Navbar />
       <main className="flex-1 py-8 px-4 max-w-6xl mx-auto w-full">
+        <FunnelTracker eventId={event.id} stage="view" />
         <div className="grid lg:grid-cols-3 gap-8">
           <div className="lg:col-span-2 space-y-6">
             {event.picture ? (

frontend/src/app/layout.tsx

@@ -8,6 +8,7 @@ import { ToastProvider } from "@/components/shared/ToastProvider";
 import { BannerBar } from "@/components/shared/BannerBar";
 import { SetupGuard } from "@/components/shared/SetupGuard";
 import HelpFab from "@/components/shared/HelpFab";
+import { CookieConsent } from "@/components/shared/CookieConsent";
 import { API_BASE, resolveToApiOrigin } from "@/lib/api";
 import { buildThemeCssVars } from "@/lib/colorScale";
 import { appUrl } from "@/lib/siteConfig";
@@ -96,6 +97,7 @@ export default async function RootLayout({ children }: { children: React.ReactNo
                             <BannerBar />
                             {children}
                             <HelpFab />
+                            <CookieConsent />
                         </ToastProvider>
                     </AuthProvider>
                 </SiteSettingsProvider>

frontend/src/app/legal/privacy/page.tsx

@@ -192,6 +192,7 @@ function Section({
         ],
         cookies: [
             "This website uses browser localStorage to store your login session token and user interface preferences (such as dismissed notifications). No third-party cookies, tracking pixels, or analytics tools are used.",
+            "If you choose \"Allow\" on the cookie notice, we also keep a random, anonymous visit identifier so we can count, in our own statistics, how many visitors view an event, start registering, and complete a registration. We record only that step, where the visit came from (for example a short link) and the type of device — never your name, IP address or browsing history. Detailed records are combined into daily totals after 90 days. If you choose \"No thanks\", nothing is counted.",
             "You can clear your browser's local storage at any time through your browser settings, which will log you out of the site.",
         ],
         security: [

frontend/src/app/register/[eventId]/RegisterForm.tsx

@@ -6,6 +6,7 @@ import { apiFetch } from "@/lib/api";
 import { CouponCodeField, AppliedCoupon } from "@/components/shared/CouponCodeField";
 import { AttendeeNamesEditor, AttendeeEntries, TicketDelivery, attendeesPayload, consentDetailsMissing } from "@/components/shared/AttendeeNamesEditor";
 import { JoinWaitlistButton } from "@/components/events/JoinWaitlistButton";
+import { analyticsSessionId } from "@/lib/analytics";
 
 // Tiered low-stock threshold — mirrors events/[id]/page.tsx
 function lowStockThreshold(stockLimit: number): number {
@@ -393,7 +394,7 @@ export default function RegisterForm({ event: baseEvent }: { event: Event }) {
         setCreatingRegistration(true);
         const res = await apiFetch<{ id: string; totalDueComputed?: number }>("/api/registrations", {
           method: "POST",
-          body: { eventId, options: items, waitlistToken, ...(namedAttendees().length > 0 ? { attendees: namedAttendees(), ticketDelivery: delivery } : {}) },
+          body: { eventId, options: items, waitlistToken, analyticsSessionId: analyticsSessionId(), ...(namedAttendees().length > 0 ? { attendees: namedAttendees(), ticketDelivery: delivery } : {}) },
         });
         if (res?.id) window.location.href = `/registration/success?registrationId=${encodeURIComponent(res.id)}&totalDue=${encodeURIComponent((res.totalDueComputed ?? payable).toFixed(2))}`;
       } catch (e: any) {
@@ -419,6 +420,7 @@ export default function RegisterForm({ event: baseEvent }: { event: Event }) {
             eventId,
             options: items,
             ...(coupon ? { couponCode: coupon.code } : {}),
+            analyticsSessionId: analyticsSessionId(),
             ...(namedAttendees().length > 0 ? { attendees: namedAttendees(), ticketDelivery: delivery } : {}),
             ...(waitlistToken ? { waitlistToken } : {}),
           },
@@ -463,6 +465,7 @@ export default function RegisterForm({ event: baseEvent }: { event: Event }) {
         method: "POST",
         body: {
           eventId, options: items, guestName: guestName.trim(), guestEmail: guestEmail.trim(), guestPhone: guestPhone.trim() || undefined,
+          analyticsSessionId: analyticsSessionId(),
           ...(namedAttendees().length > 0 ? { attendees: namedAttendees(), ticketDelivery: delivery } : {}),
         },
       });

frontend/src/app/register/[eventId]/page.tsx

@@ -3,6 +3,7 @@ import { Navbar } from "@/components/layout/Navbar";
 import { Footer } from "@/components/layout/Footer";
 import { apiFetch, ApiError } from "@/lib/api";
 import RegisterForm from "./RegisterForm";
+import { FunnelTracker } from "@/components/events/FunnelTracker";
 
 export const revalidate = 60;
 
@@ -28,6 +29,7 @@ export default async function RegisterPage({ params }: { params: Promise<{ event
     <div className="min-h-screen flex flex-col">
       <Navbar />
       <main className="flex-1 p-6 max-w-2xl mx-auto w-full">
+        <FunnelTracker eventId={event.id} stage="start" />
         <RegisterForm event={event} />
       </main>
       <Footer />

frontend/src/components/events/FunnelTracker.tsx

@@ -0,0 +1,15 @@
+"use client";
+
+import { useEffect } from "react";
+import { CONSENT_EVENT, trackFunnel } from "@/lib/analytics";
+
+/** Records a funnel step for this page (once consent is given, even if given later). */
+export function FunnelTracker({ eventId, stage }: { eventId: string; stage: "view" | "start" }) {
+  useEffect(() => {
+    trackFunnel(eventId, stage);
+    const onConsent = () => trackFunnel(eventId, stage);
+    window.addEventListener(CONSENT_EVENT, onConsent);
+    return () => window.removeEventListener(CONSENT_EVENT, onConsent);
+  }, [eventId, stage]);
+  return null;
+}

frontend/src/components/reports/ReportCatalog.ts

@@ -17,6 +17,7 @@ import {
   ShieldCheck,
   HeartPulse,
   MessageSquareHeart,
+  Filter,
 } from "lucide-react";
 
 export type ReportCategory = "Financial" | "Registration" | "Ticketing" | "Donations" | "Cashup" | "Other";
@@ -38,6 +39,7 @@ export const REPORTS = [
   { key: "profitReport", label: "Profit report", description: "View profit report", category: "Financial", icon: BarChart3, fields: 5 },
   { key: "cashupAudit", label: "Cashup audit trail", description: "Audit trail of cashup actions", category: "Cashup", icon: ClipboardList, fields: 6 },
   { key: "consentStatus", label: "Parental consent status", description: "Youth events: consent per attendee", category: "Registration", icon: ShieldCheck, fields: 5 },
+  { key: "funnel", label: "Registration funnel", description: "Event page views → started → submitted → paid, with trend and sources", category: "Registration", icon: Filter, fields: 5 },
   { key: "feedbackSummary", label: "Feedback summary", description: "Post-event feedback: ratings, choices and comments; compare events", category: "Registration", icon: MessageSquareHeart, fields: 4 },
   { key: "medicalList", label: "Medical & emergency list", description: "Youth events: confidential list for leaders (audited)", category: "Registration", icon: HeartPulse, fields: 5 },
   { key: "discounts", label: "Discounts (coupon codes)", description: "Uses and value given away per code and event", category: "Financial", icon: TicketPercent, fields: 4 },

frontend/src/components/reports/ReportsV2.tsx

@@ -5,12 +5,13 @@ import { useSearchParams } from "next/navigation";
 import { useAuth } from "@/hooks/useAuth";
 import { apiFetch, API_BASE } from "@/lib/api";
 import { downloadReportExcel, emailReportPdf, whatsappReportPdf, viewReportPdf, type ReportPdfPayload } from "@/lib/export";
-import { Printer, Mail, FileSpreadsheet, MessageCircle, ShoppingCart, CreditCard, Gift, Clock, HandHeart, Search, TrendingUp, TicketPercent, ShieldCheck, Star, MessageSquareHeart, Send } from "lucide-react";
+import { Printer, Mail, FileSpreadsheet, MessageCircle, ShoppingCart, CreditCard, Gift, Clock, HandHeart, Search, TrendingUp, TicketPercent, ShieldCheck, Star, MessageSquareHeart, Send, Eye, MousePointerClick, BadgeCheck } from "lucide-react";
 import { REPORTS, type ReportKey } from "./ReportCatalog";
 import ReportsShell from "./ReportsShell";
 import ReportViewerModal, { ReportActionButton } from "./ReportViewerModal";
 import { StatTile, StatTileRow } from "./StatTile";
 import { HorizontalBarChart } from "./charts/HorizontalBarChart";
+import { AreaTrendChart } from "@/components/charts/AreaTrendChart";
 
 const METHOD_KEYS = ["cash", "card", "eft", "other"] as const;
 const METHOD_LABEL: Record<string, string> = { cash: "Cash", card: "Card", eft: "EFT", other: "Other" };
@@ -179,6 +180,8 @@ export default function ReportsV2({ onBack }: { onBack?: () => void } = {}) {
   const [medicalRows, setMedicalRows] = useState<any[]>([]);
   // Post-event feedback, one entry per event that had a feedback form.
   const [feedbackRows, setFeedbackRows] = useState<any[]>([]);
+  // Registration funnel for the selected events (null until viewed).
+  const [funnel, setFunnel] = useState<any | null>(null);
 
   // Deep-linking: dashboards link here with ?report=<key>&range=trailing_month to jump
   // straight into a specific report, pre-filtered to every currently-visible event and the
@@ -288,6 +291,18 @@ export default function ReportsV2({ onBack }: { onBack?: () => void } = {}) {
     return byEv;
   };
 
+  const loadFunnel = async (eventIds: string[]) => {
+    if (!token || !eventIds.length) return null;
+    const query = new URLSearchParams({ eventIds: eventIds.join(",") });
+    if (dateFrom) query.set("from", dateFrom);
+    if (dateTo) query.set("to", dateTo);
+    try {
+      return await apiFetch<any>(`/api/analytics/funnel?${query.toString()}`, { authToken: token });
+    } catch {
+      return null;
+    }
+  };
+
   const loadFeedback = async (eventIds: string[]) => {
     if (!token || !eventIds.length) return [] as any[];
     try {
@@ -443,6 +458,8 @@ export default function ReportsV2({ onBack }: { onBack?: () => void } = {}) {
         setDiscountRows(await loadDiscounts(selectedEventIds));
       } else if (report === "consentStatus") {
         setConsentRows(await loadConsent(selectedEventIds, "status"));
+      } else if (report === "funnel") {
+        setFunnel(await loadFunnel(selectedEventIds));
       } else if (report === "feedbackSummary") {
         setFeedbackRows(await loadFeedback(selectedEventIds));
       } else if (report === "medicalList") {
@@ -1040,6 +1057,31 @@ export default function ReportsV2({ onBack }: { onBack?: () => void } = {}) {
         },
       };
     }
+    if (report === "funnel" && funnel) {
+      const pct = (v: number | null) => (v != null ? `${v}%` : "—");
+      const line = (label: string, c: any) => [label, c.view, c.start, c.submit, c.paid, pct(c.conversion ?? (c.view ? Math.round((c.paid / c.view) * 1000) / 10 : null))];
+      const rows: (string | number)[][] = [
+        line("All selected events", funnel.totals),
+        ...(funnel.perEvent || []).length > 1 ? funnel.perEvent.map((p: any) => line(p.title, p.totals)) : [],
+        ...funnel.bySource.map((s: any) => line(`Source: ${s.key}`, s)),
+        ...funnel.byDevice.map((d: any) => line(`Device: ${d.key}`, d)),
+        ...funnel.byOption.map((o: any) => [`Ticket: ${o.key}`, "", "", o.submitted, o.paid, ""]),
+      ];
+      return {
+        title: 'Registration funnel', subtitle, kind: 'table', orientation: 'landscape',
+        stats: [
+          { label: 'Event page visits', value: String(funnel.totals.view), tone: 'blue' },
+          { label: 'Paid', value: String(funnel.totals.paid), tone: 'green' },
+          { label: 'Conversion', value: pct(funnel.conversion.paid), tone: 'violet' },
+        ],
+        chart: { title: 'Visitors reaching each stage', data: [
+          { label: 'Viewed event', value: funnel.totals.view }, { label: 'Started', value: funnel.totals.start },
+          { label: 'Submitted', value: funnel.totals.submit }, { label: 'Paid', value: funnel.totals.paid },
+        ] },
+        note: 'Counts only visitors who allowed cookies. A visitor counts at a stage if they got that far or further.',
+        table: { columns: ["Breakdown", "Viewed", "Started", "Submitted", "Paid", "Conversion"], rows },
+      };
+    }
     if (report === "feedbackSummary") {
       const rows: (string | number)[][] = [];
       for (const f of feedbackSummary.perEvent) {
@@ -1727,6 +1769,77 @@ export default function ReportsV2({ onBack }: { onBack?: () => void } = {}) {
               )}
             </div>
           )}
+          {report === "funnel" && (
+            <div>
+              {!funnel || funnel.totals.view === 0 ? (
+                <div className="text-sm text-gray-500">No tracked visits for the selected events and dates yet. Only visitors who allow cookies are counted.</div>
+              ) : (() => {
+                const pct = (v: number | null) => (v != null ? `${v}%` : "—");
+                const stages = [
+                  { label: "Viewed event", value: funnel.totals.view },
+                  { label: `Started (${pct(funnel.conversion.start)})`, value: funnel.totals.start },
+                  { label: `Submitted (${pct(funnel.conversion.submit)})`, value: funnel.totals.submit },
+                  { label: `Paid (${pct(funnel.conversion.paid)})`, value: funnel.totals.paid },
+                ];
+                const table = (title: string, rows: any[]) => rows.length === 0 ? null : (
+                  <div className="mt-4 overflow-auto border border-gray-100 rounded-xl">
+                    <table className="min-w-[560px] w-full">
+                      <thead>
+                        <tr className="text-left text-gray-500 text-xs uppercase tracking-wide bg-gray-50">
+                          <th className="py-2 px-3">{title}</th><th className="py-2 px-3 text-right">Viewed</th><th className="py-2 px-3 text-right">Started</th>
+                          <th className="py-2 px-3 text-right">Submitted</th><th className="py-2 px-3 text-right">Paid</th><th className="py-2 px-3 text-right">Conversion</th>
+                        </tr>
+                      </thead>
+                      <tbody>
+                        {rows.map((r: any) => (
+                          <tr key={r.key} className="border-t border-gray-100">
+                            <td className="py-2 px-3">{r.key}</td><td className="py-2 px-3 text-right">{r.view}</td><td className="py-2 px-3 text-right">{r.start}</td>
+                            <td className="py-2 px-3 text-right">{r.submit}</td><td className="py-2 px-3 text-right">{r.paid}</td><td className="py-2 px-3 text-right">{pct(r.conversion)}</td>
+                          </tr>
+                        ))}
+                      </tbody>
+                    </table>
+                  </div>
+                );
+                return (
+                  <>
+                    <StatTileRow>
+                      <StatTile icon={Eye} label="Event page visits" value={String(funnel.totals.view)} tone="blue" />
+                      <StatTile icon={MousePointerClick} label="Started registering" value={String(funnel.totals.start)} tone="amber" />
+                      <StatTile icon={BadgeCheck} label="Paid" value={`${funnel.totals.paid} (${pct(funnel.conversion.paid)})`} tone="green" />
+                    </StatTileRow>
+                    <div className="mt-4 border border-gray-100 rounded-xl p-4">
+                      <div className="text-xs text-gray-500 mb-3">Visitors reaching each stage (% of event page visits)</div>
+                      <HorizontalBarChart data={stages} valueFormatter={v => String(v)} />
+                      <div className="text-xs text-gray-500 mt-2">Started → submitted: {pct(funnel.conversion.startToSubmit)} · Submitted → paid: {pct(funnel.conversion.submitToPaid)}</div>
+                    </div>
+                    {funnel.trend.length > 1 && (
+                      <div className="mt-4 border border-gray-100 rounded-xl p-4">
+                        <div className="text-xs text-gray-500 mb-3">Event page visits per day</div>
+                        <AreaTrendChart data={funnel.trend.map((t: any) => ({ label: t.day.slice(5), value: t.view }))} />
+                      </div>
+                    )}
+                    {(funnel.perEvent || []).length > 1 && table("Event", funnel.perEvent.map((p: any) => ({ key: p.title, ...p.totals, conversion: p.conversion.paid })))}
+                    {table("Source", funnel.bySource)}
+                    {table("Device", funnel.byDevice)}
+                    {funnel.byOption.length > 0 && (
+                      <div className="mt-4 overflow-auto border border-gray-100 rounded-xl">
+                        <table className="min-w-[400px] w-full">
+                          <thead><tr className="text-left text-gray-500 text-xs uppercase tracking-wide bg-gray-50"><th className="py-2 px-3">Ticket option</th><th className="py-2 px-3 text-right">Registrations</th><th className="py-2 px-3 text-right">Paid</th></tr></thead>
+                          <tbody>
+                            {funnel.byOption.map((o: any) => (
+                              <tr key={o.key} className="border-t border-gray-100"><td className="py-2 px-3">{o.key}</td><td className="py-2 px-3 text-right">{o.submitted}</td><td className="py-2 px-3 text-right">{o.paid}</td></tr>
+                            ))}
+                          </tbody>
+                        </table>
+                      </div>
+                    )}
+                    <p className="text-xs text-gray-500 mt-3">Only visitors who allowed cookies are counted. A visitor counts at a stage if they got that far or further. Sources come from utm_source links and short links.</p>
+                  </>
+                );
+              })()}
+            </div>
+          )}
           {report === "feedbackSummary" && (
             <div>
               {feedbackSummary.perEvent.length === 0 ? (

frontend/src/components/shared/CookieConsent.tsx

@@ -0,0 +1,32 @@
+"use client";
+
+import React, { useEffect, useState } from "react";
+import Link from "next/link";
+import { Cookie } from "lucide-react";
+import { getConsent, setConsent } from "@/lib/analytics";
+
+/**
+ * Asks once whether we may use a cookie-like identifier to count visits (our own
+ * registration-funnel stats). Declining changes nothing else about the site.
+ */
+export function CookieConsent() {
+  const [show, setShow] = useState(false);
+  useEffect(() => { setShow(getConsent() === null); }, []);
+  if (!show) return null;
+  const choose = (v: "accepted" | "declined") => { setConsent(v); setShow(false); };
+  return (
+    <div className="fixed bottom-0 inset-x-0 z-40 p-3 sm:p-4 pointer-events-none" role="region" aria-label="Cookie consent">
+      <div className="pointer-events-auto max-w-3xl mx-auto bg-white border shadow-lg rounded-xl p-4 flex flex-col sm:flex-row sm:items-center gap-3">
+        <Cookie className="w-6 h-6 text-brand-600 shrink-0 hidden sm:block" />
+        <p className="text-sm text-gray-700 flex-1">
+          May we count your visit? We use our own anonymous statistics (no third-party analytics) to see how people find and register for events.{" "}
+          <Link href="/legal/privacy#cookies" className="text-brand-700 underline">Privacy policy</Link>
+        </p>
+        <div className="flex gap-2 shrink-0">
+          <button onClick={() => choose("declined")} className="px-3 py-1.5 text-sm rounded-lg border hover:bg-gray-50">No thanks</button>
+          <button onClick={() => choose("accepted")} className="px-3 py-1.5 text-sm rounded-lg bg-brand-600 text-white hover:bg-brand-700">Allow</button>
+        </div>
+      </div>
+    </div>
+  );
+}

frontend/src/components/shared/StatCard.tsx

@@ -66,6 +66,6 @@ export function StatCard({
   );
 }
 
-export function StatCardRow({ children }: { children: React.ReactNode }) {
+export function StatCardRow({ children, cols = 5 }: { children: React.ReactNode; cols?: 5 | 6 }) {
-  return <div className="grid grid-cols-1 sm:grid-cols-3 lg:grid-cols-5 gap-4">{children}</div>;
+  return <div className={`grid grid-cols-1 sm:grid-cols-3 ${cols === 6 ? "lg:grid-cols-6" : "lg:grid-cols-5"} gap-4`}>{children}</div>;
 }

frontend/src/content/help/reports.tsx

@@ -29,7 +29,7 @@ export const reportsHelpContent: HelpContent = {
               Preview your report, adjust filters, and choose how you want the data to appear.
             </GuideItem>
             <GuideItem icon={Download} title="Export or email" tone="amber">
-              Export your report to Excel, PDF, or send it by email or WhatsApp. Tip: select several events in the Feedback summary to compare their ratings (e.g. Camp 2025 vs Camp 2026).
+              Export your report to Excel, PDF, or send it by email or WhatsApp. Tip: select several events in the Feedback summary to compare their ratings (e.g. Camp 2025 vs Camp 2026). The Registration funnel shows where people drop off between viewing an event and paying, by source (short links and utm_source links) and device. It counts only visitors who allowed cookies.
             </GuideItem>
           </div>
         </div>

frontend/src/lib/analytics.ts

@@ -0,0 +1,68 @@
+"use client";
+
+/**
+ * First-party registration-funnel tracking. Nothing is tracked until the visitor accepts
+ * cookies (CookieConsent); then a random session id is kept in localStorage and the
+ * event page ("view") and registration page ("start") report to our own API. No
+ * third-party analytics, and no personal data — the server records only the stage, the
+ * traffic source and a device type.
+ */
+import { API_BASE } from "@/lib/api";
+
+const CONSENT_KEY = "hope_events_cookie_consent";
+const SESSION_KEY = "hope_events_analytics_sid";
+export const CONSENT_EVENT = "hope-events-consent";
+
+export type Consent = "accepted" | "declined" | null;
+
+export function getConsent(): Consent {
+  try {
+    const v = localStorage.getItem(CONSENT_KEY);
+    return v === "accepted" || v === "declined" ? v : null;
+  } catch {
+    return null;
+  }
+}
+
+export function setConsent(v: "accepted" | "declined") {
+  try {
+    localStorage.setItem(CONSENT_KEY, v);
+    if (v === "declined") localStorage.removeItem(SESSION_KEY);
+  } catch { /* storage unavailable */ }
+  try { window.dispatchEvent(new Event(CONSENT_EVENT)); } catch { /* no window */ }
+}
+
+/** The anonymous session id — only when cookies were accepted. */
+export function analyticsSessionId(): string | undefined {
+  if (getConsent() !== "accepted") return undefined;
+  try {
+    let id = localStorage.getItem(SESSION_KEY);
+    if (!id) {
+      id = crypto.randomUUID();
+      localStorage.setItem(SESSION_KEY, id);
+    }
+    return id;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Where the visitor came from: ?utm_source=… or ?src=<short-link alias>. */
+function sourceFromUrl(): string | undefined {
+  try {
+    const p = new URLSearchParams(window.location.search);
+    return p.get("utm_source") || p.get("src") || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Reports a funnel step. Silently does nothing without consent or on any error. */
+export function trackFunnel(eventId: string, stage: "view" | "start") {
+  const sessionId = analyticsSessionId();
+  if (!sessionId || !eventId) return;
+  const body = JSON.stringify({ sessionId, eventId, stage, source: sourceFromUrl() });
+  try {
+    fetch(`${API_BASE}/api/analytics/track`, { method: "POST", headers: { "Content-Type": "application/json" }, body, keepalive: true }).catch(() => {});
+  } catch { /* ignore */ }
+}

info.md

@@ -30,6 +30,7 @@ It runs in any web browser — on a phone, tablet, or computer — with nothing
 ### For staff on the day
 
 - **QR code scanner** — check people in by scanning their ticket with any phone camera. A single ticket can cover a whole family and be checked in a few people at a time.
+- **See where people drop off** — a privacy-friendly funnel (no Google Analytics) shows how many people viewed an event, started registering and paid, and which links and short URLs brought them.
 - **Feedback after every event** — a short survey with star ratings goes out automatically the morning after, with one reminder. See response rates and compare this year's camp with last year's.
 - **Sponsor a spot** — let your congregation fund places for people who can't afford to come, with an optional "12 of 20 spots sponsored" progress bar. You decide who receives the help; sponsors never see who.
 - **Rooms & groups for camps** — drag campers into cabins, small groups or buses (or auto-fill by capacity and gender), print lists for leaders, and show the cabin on each ticket.

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "hope-events",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hope-events",
-      "version": "1.21.0",
+      "version": "1.22.0",
       "license": "ISC",
       "devDependencies": {
         "concurrently": "^9.2.1"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hope-events",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "main": "index.js",
   "scripts": {
     "dev:backend": "cd backend && npm run dev",