feat: add privacy-preserving click analytics and a /privacy page

[viganogabriele]

Summary

• Adds aggregate-only click analytics per URL, stored across 3 new tables (click_analytics_buckets, click_country_analytics, daily_unique_click_dedup) — never raw IP, User-Agent, or per-click timestamps.
• Country is read only from trusted edge/CDN headers (Cloudflare cf-ipcountry, Vercel x-vercel-ip-country, or a configurable GEO_COUNTRY_HEADER) — no third-party geolocation lookups.
• Unique-visitor estimates use a same-day HMAC-SHA256 hash (ANALYTICS_HASH_SECRET) that rotates every UTC day, so it can't track a visitor across days or links; the hash rows are purged after ~24-48h (opportunistic purge on ~2% of clicks, since serverless has no long-lived cron).
• New endpoint GET /urls/:shortCode/analytics; an "Analytics" button/dialog on each URL row shows total clicks, today's unique estimate, top countries, a recent-trend sparkline, and hour/day/month bar charts (hand-rolled, no charting dependency added).
• New /privacy page disclosing exactly what is and isn't collected, linked from the analytics dialog.
• Click recording happens in next/server's after() so it never delays or breaks the redirect; failures are logged generically (no IP/UA ever logged).

Scope decisions

• Simplified vs. vigab.cc: upstream tracks analytics per-scope (whole link / primary code / each alias) because that repo has an alias feature. This repo has no alias concept, so this port uses a single scope per URL — simpler schema and queries. If/when an alias feature is added later, extending this schema with a scope column is a small, additive migration; not worth the complexity now.
• Privacy page placeholders: the "data controller" contact (info@polinetwork.org, marked with a TODO(PoliNetwork)) and the "Hosting" section (deliberately generic — I don't know PoliNetwork's actual infrastructure providers, unlike vigab.cc's Vercel/Cloudflare-specific version) need PoliNetwork to confirm/fill in before this page is relied on as a complete legal disclosure. Flagging this explicitly rather than fabricating specifics.
• ANALYTICS_HASH_SECRET is a required new env var (min 16 chars) — vigab.cc falls back to its NEXTAUTH_SECRET (an auth secret this repo doesn't have), so a dedicated required secret is the cleaner fit here. Documented in .env.example.

Dependency

Builds on #27 (vitest + pg-mem test infra), same as #28 (tagging) — both add tests that need that harness. If #27 hasn't merged yet, this branch includes its commit; rebase onto main once #27 merges.

Test plan

• pnpm test — 25 tests pass (analytics bucketing/dedup/purge logic, geo header parsing)
• pnpm check (biome) passes
• pnpm build succeeds
• Manual: click a short link a few times, open its Analytics dialog, confirm counts/charts/countries render; visit /privacy

[coderabbitai]

Warning

Review limit reached

@viganogabriele, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 32 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4dfd76f8-9ddc-4779-9300-f71ec7adfa9b

📥 Commits

Reviewing files that changed from the base of the PR and between 8fb680c and 02ebb17.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (21)

• .env.example
• package.json
• src/app/[shortCode]/page.tsx
• src/app/api/[...ts-rest]/route.ts
• src/app/privacy/page.tsx
• src/components/analytics-chart.tsx
• src/components/analytics-dialog.tsx
• src/components/dashboard.tsx
• src/components/url-record-row.tsx
• src/env.ts
• src/hooks/urls.ts
• src/lib/analytics-schema.ts
• src/lib/analytics-service.test.ts
• src/lib/analytics-service.ts
• src/lib/contract.ts
• src/lib/db.ts
• src/lib/geo.test.ts
• src/lib/geo.ts
• src/lib/schemas.ts
• src/lib/url-service.test.ts
• vitest.config.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}