Script configuration

The full reference for the sa.js snippet: the attributes you can set on the <script> tag, the JavaScript API it exposes, and the cookies it uses.

Script attributes


<script defer
  src="https://api.snowanalytics.app/sa.js"
  data-site="YOUR_SITE_ID"
  data-api-url="https://api.snowanalytics.app/api/collect"
  data-mode="cookieless"
  data-domain="example.com"></script>

Attribute	Required	Default	Purpose
`data-site`	Yes	(none)	Your Site ID. Without it the script does nothing.
`data-api-url`	No	The `/api/collect` path next to the script’s URL	Where events are sent. Set this when using a first-party proxy so events post to the right endpoint.
`data-mode`	No	`cookieless`	Set to `attribution` for cookie-based returning-visitor tracking.
`data-domain`	No	(none)	Your registrable domain (e.g. `example.com`). Lets one visitor be a single identity across subdomains like `app.example.com`.
`data-honor-dnt`	No	`true`	Honor Do Not Track / Global Privacy Control: when the visitor’s browser sends one, nothing is tracked. Set `false` to ignore them.

You normally don’t set these by hand: copy the ready-made snippet from Settings → Tracking, and it includes whatever your site needs.

JavaScript API

The snippet exposes a global object available as window.sa (also window.snow and window.__sa, all the same object).

Call	Description
`sa.track(name, properties?, options?)`	Track a custom event.
`sa.page(path?)`	Record a page view; optionally for a specific path. See SPAs.
`sa.identify(userId, traits?)`	Identify the current visitor.
`sa.optout()`	Stop tracking on this device and clear any stored ID (persists across page loads).
`sa.optin()`	Resume tracking after `sa.optout()` (still subject to Do Not Track / GPC).
`sa.getVisitorId()`	The current visitor ID (empty in cookieless mode).
`sa.getSessionId()`	The current session ID (empty in cookieless mode).
`sa.mode`	`"attribution"` or `"cookieless"`.

You can also call the global as a function, useful for calls before the script loads, which are queued and run on load:


sa("track", "signup", { plan: "pro" });
sa("purchase", { plan: "pro" }); // a bare name is treated as an event

Cookies it sets

In attribution mode, the snippet sets first-party cookies (with matching local/session storage), all SameSite=Lax:

Cookie	Lifetime	Purpose
`_sa_vid`	1 year	Visitor ID: recognizes a returning visitor.
`_sa_sid`	30 minutes	Session ID: groups page views into one visit.
`_sa_sts`	Session	Session timestamp (in `sessionStorage`).

In cookieless mode the snippet sets no cookies or storage at all. Identity is derived on the server instead. Nothing is stored either when a visitor has opted out or sends a Do Not Track / Global Privacy Control signal.

These are first-party cookies on your own domain. They aren’t shared with any third party and aren’t used for cross-site advertising.