What we shipped, and when.

GetFluxly is live for everyone.

The waitlist is gone. Anyone can sign up and start a 14 day trial with no card required, on one $29 plan with everything included.

The homepage is redesigned, and the site now has real product pages for the pieces of the platform, including a new AI Studio page that walks through what the in-Console assistant drafts for you.

• The waitlist wall is down: sign up and get started the same day.
• A 14 day trial, no card required.
• One $29 plan, everything included, no tiers.
• A redesigned homepage and real product pages across the site.

Truer counts and truer session times.

Bot detection now weighs how a visit actually behaves instead of guessing from the user agent alone, so a real person on an unusual browser is no longer written off as a bot and dropped from your counts.

Session durations and time-on-page now measure the time a page was actually visible, not wall-clock time that keeps running while the tab sits in the background, and page-leave events fire on real exits. The result is visitor counts and session times that match what people actually did.

• Bot detection uses engagement signals, not user-agent guessing alone.
• Real visitors on unusual browsers are no longer miscounted as bots.
• Durations and time-on-page count only the time a page was visible.
• Page-leave events fire on real exits.

Verified Resend webhooks, end to end.

Connecting Resend webhooks now works the way Resend intends. You paste in the signing secret Resend gives you, and every incoming event is checked against a real Svix signature before it is accepted, so delivery, open, and click events are verified end to end before they ever touch your data.

• Paste in the signing secret from Resend to connect webhooks.
• Every event is verified with a real Svix signature check.
• Delivery, open, and click events are trusted only after they pass.

A default email provider per channel.

Each sending channel can now carry a default email provider. Pickers are channel-first: choose the channel and the default provider fills itself in, so automations and broadcasts send through the right provider without you configuring it on every send.

• Set a default email provider on each sending channel.
• Channel-first pickers auto-fill that default.
• Automations and broadcasts pick the right provider with no per-send setup.

A brand kit from your own website.

Point GetFluxly at your site and, with your say-so, it reads your logo, colors, OG snippet, sitemap, and docs links into a brand kit. The scan is fully opt-in and polite: it visits one page at a time and stays throttled so it never leans on your site.

With a brand kit in place, AI Studio drafts sound like your product and link to your real docs instead of generic placeholders.

• Opt-in scan pulls your logo, colors, OG snippet, sitemap, and docs links.
• AI Studio drafts then match your voice and link your real docs.
• Fully opt-in, one page at a time, throttled and polite to your site.

AI Studio, faster and steadier.

Studio replies now stream in as they are written instead of landing all at once, so you see the draft take shape instead of waiting for the whole thing. Reliability is up on the harder drafts too, with fewer retries needed on multi-step automations.

The builder around it got tidier: artifact tabs now tuck extras into an overflow menu, the add-step control sits where you expect it, and the draft bar no longer overlaps the canvas.

• Replies stream in as they are generated, not all at once.
• Fewer retries on complex, multi-step drafts.
• Artifact tabs gained an overflow menu and the add-step control moved where you expect it.
• The draft bar no longer overlaps the canvas.

A plain-English get started guide.

A new get started guide walks you through setup in plain language, from dropping in the install snippet to building your first automation.

It is linked from the homepage and from inside the Console, so it is one click away whether you are still deciding or already set up.

An Events catalog for your whole schema.

A new Events catalog lists every event your product has ever sent, grouped by where it came from: the browser SDK, a server SDK, or an import. Each event shows how many times it has arrived and when it was last seen.

It gives you your schema at a glance, which makes it easy to spot events that have gone quiet or that were misnamed.

• Every event your product has sent, in one place.
• Grouped by origin: browser SDK, server SDK, and imports.
• Counts and last-seen times on every event.
• Spot dead or misnamed events at a glance.

A richer Overview.

The Overview picked up page-level metrics, a merged traffic card, and an identity-links tab, laid out on a symmetric tiered card grid so the page reads cleanly top to bottom. The top events and top pages cards now pull more rows to fill their space instead of trailing off early.

• Page-level metrics on the Overview.
• A merged traffic card and a new identity-links tab.
• A symmetric tiered card grid.
• Top events and pages cards fill their space with more rows.

One plan. Everything included.

Pricing is now a single plan. Every account gets the whole product for $29 a month, with 2,500 identified profiles included, then the price scales only with your audience through the slider on the pricing page. Events are never billed, and nothing is gated behind a higher tier.

Adding a card during your 14 day trial is optional and instantly raises your weekly AI limits, with no charge until your plan starts. If you never add one, your account simply pauses when the trial ends, and your data is kept.

• One plan at $29 a month, everything included, no tiers and no feature gating.
• Priced only by identified profiles: 2,500 included, then it scales with your audience.
• Events are never billed.
• Optional card during the trial unlocks higher AI limits, with no charge until day 14.

Cookieless analytics, on by default.

GetFluxly now tracks anonymous visitors without setting a single cookie or writing anything to the browser. Instead of planting an id on the device, our server derives a short-lived hashed id from the incoming request, salted with a secret that rotates and is deleted every day, so the id can group one visit but cannot follow anyone from one day to the next.

A real, persistent identity begins only when a visitor signs up, logs in, or submits a form. Until then there is nothing stored on their device and nothing to link across sites. We turned this on first for our own marketing site and docs: the old consent banner is gone, replaced by a one-line notice that stores nothing.

The full breakdown, including the honest tradeoffs, lives on the cookieless analytics page.

• No cookies, no localStorage, and no fingerprinting for anonymous traffic.
• A daily-rotating server-side salt, so anonymous ids cannot be linked across days.
• Identity starts the moment someone signs up or logs in, never before.
• Sessions, funnels, referrers, and campaign attribution still work in full.

AI Studio: describe it, get a working draft.

A new chat-first assistant now lives inside the Console. Describe what you want in plain English, for example 'a three-step welcome series for new signups' or 'a segment of users who viewed pricing but did not convert', and Studio drafts it using the same builders and validation you would use by hand, ready for you to review and save.

It drafts automations, segments, email templates, and funnels, and it can answer questions about what you already have. Studio only ever produces drafts: it never sends, activates, or changes anything on its own, and it sees only your event and property names, never your customers' data.

• Drafts automations, segments, email templates, and funnels from a prompt.
• Plain questions and 'what do I have?' lookups do not spend your AI budget.
• Draft-only by design: nothing is sent, activated, or deleted without you.
• Reads your schema (event and trait names) only, never end-user data.

Slack alerts from your automations.

Automations can now post to Slack. Add a Notify Slack step to any flow to fire an alert when a user hits a milestone, a churn risk triggers, or a funnel stalls. Connect your workspace once from the new Slack Integration page in settings, and AI Studio can suggest and wire up the step for you.

Session Streams: read and filter every visit.

The sessions view is now Session Streams. Each visit reads as a clean summary with city and country, referrer, time on page, and a compact event timeline. New filters let you narrow by country, identified versus anonymous, and bot traffic, and clicking a referrer, channel, or campaign anywhere in analytics drops you straight into the matching, filtered sessions.

• City and country location on both the sessions list and the detail page.
• Filter by country, identified versus anonymous, and bots.
• Click any referrer, channel, or campaign to jump to those exact sessions.
• Bot visits are labeled inline, and zero-duration bot hits are flagged.

Cleaner analytics, numbers you can trust.

A pass focused on making the data trustworthy. We removed Google Analytics from our own site entirely, so getfluxly.com is now first-party only. We tightened what can ever reach analytics so one-time codes in sign-in and reset links can no longer be swept in. And we fixed a bug where events sent from your own servers through the Python and Ruby SDKs were wrongly discarded as bot traffic.

• Server-sent events via the Python and Ruby SDKs are no longer misclassified as bots.
• One-time codes and tokens are scrubbed before anything is stored.
• Google Analytics removed from getfluxly.com; tracking is first-party only.
• A stale-tab banner prompts a refresh when a dashboard has been open long enough to drift.

Simpler pricing: Base and Growth.

Pricing is now two plans instead of four. Base is a flat monthly price for smaller lists. Growth adds branded tracking links, Stripe revenue tracking, webhooks, multiple projects, and a larger AI allowance, and it scales with your contact count through a slider you can estimate against before you commit.

Every plan includes the full product and all six SDKs, and compliance features such as unsubscribe links and GDPR erasure are never paywalled. Growth comes with a 14-day trial and no card required.

A fresh look for getfluxly.com.

The marketing site moved onto a new design system with refreshed typography and layout across the home page, pricing, security, and about pages, plus a set of new pages covering cookieless analytics, GDPR-compliant analytics, and moving off Google Analytics.

Bulletproof event idempotency across every SDK.

Every event your SDK sends now carries a stable message_id, generated once and reused across retries and page-leave beacons. The backend derives each stored event's id from it, so a flaky network, a retried flush, or a replayed batch collapses onto a single event instead of duplicating it.

This one came out of a multi-day hunt: our own dashboard's tracking started spawning a swarm of duplicate identify events, and the automations wired to them kept re-firing. We peeled back four layers of accomplices (retry duplicates, an over-eager identify, a shape-shifting timestamp) before finding the real culprit: identity had been quietly coupled to the data-fetching cycle. The full war story lives in our repo changelog.

• Per-event message_id idempotency shipped across all six SDKs: browser, React, Next.js, Node, Python, and Ruby.
• Deterministic, tenant-scoped event ids on the backend, so duplicate deliveries never create duplicate rows.
• Consistent timestamp serialization between cached and uncached API reads.

Surfaces, project modes, and six SDKs.

This release ships multi-surface project tracking, live/test project modes, a custom analytics time-range picker, smarter onboarding defaults, and official client libraries for six platforms.

Every item below is live in the Console and the HTTP API.

Plans and billing.

GetFluxly now has paid plans. Subscribe via Dodo Payments, start a 14-day trial that grants Growth-level access with no credit card required, and manage everything from the new Plan and billing page in account settings. Live usage meters show your consumption against each plan limit as you go.

Surfaces: track multiple properties under one project.

A project can now contain multiple surfaces. Each surface gets its own SDK API keys, its own scoped analytics view, and its own default event properties that the ingest pipeline merges automatically. A contextual switcher in the Console header lets you move between surfaces without leaving the page.

• Per-surface API keys: generate and revoke keys scoped to a single surface without touching the keys for other surfaces.
• Analytics filter: scope any dashboard to one surface or select All surfaces for a rolled-up project view.
• Default event properties: set key/value pairs at the surface level and the ingest pipeline merges them into every event that arrives on that surface.

Security hardening.

A focused security pass covering several surface areas identified during a pre-launch audit.

• GDPR profile erasure: completed the right-to-erasure flow so all personal data is purged on request.
• Closed a stored XSS vulnerability in the email template editor.
• Added an OTP brute-force ceiling on passwordless sign-in to limit enumeration attempts.
• Enforced per-IP edge rate limits on ingest and auth endpoints.
• Shipped a Safari self-heal: a stale JS chunk after a deploy no longer strands open tabs in a crash loop.

Live vs. test project mode.

Projects now carry an explicit mode: live or test. Switching modes requires confirming a modal dialog so accidental flips are prevented. Test-mode events are stored separately and do not affect live analytics or automation triggers.

Channel attribution.

Break any funnel down by acquisition source and see revenue attributed by channel. Last-touch attribution is the default. Channel classification reuses the same classify_channel logic applied at ingest so the breakdown is consistent across every analytics view.

Analytics: custom date-range picker.

Every analytics dashboard now accepts a custom date range in addition to the built-in presets. Pick any start and end date to scope funnels, retention, and event counts to the window that matters for your analysis.

Product Analytics: funnels and retention.

Build multi-step conversion funnels and track retention cohorts, now grouped together under a dedicated Product Analytics section. Define each funnel step by event name and optional property filters, then view drop-off at every stage. Retention cohorts show return rates by day and week for any anchor event.

Smarter onboarding: default surface and first SDK key created automatically.

New projects now seed a default surface during onboarding and bind the first SDK key to it automatically. You reach the Console with a working key already in place rather than needing to create the surface and key manually before your first event arrives.

Email editor: compliance footer preview.

The email editor now renders the auto-appended compliance footer inline so you see exactly what recipients will see before you send. Sender details, such as your company address and unsubscribe link text, can be configured without leaving the editor.

Cinematic onboarding.

New accounts now go through a guided post-auth onboarding flow that captures intent and configures the project around it. An intent-aware setup hub in the Console surfaces the right next steps for your use case, and a sidebar setup-progress rail tracks completion of your first-run checklist.

Passwordless sign-in.

GetFluxly now uses email-first magic-link sign-in by default. Enter your email, click the link, and you are in. The whole flow completes in the same browser tab with no password required. A one-time code option is available on request for environments where links are blocked.

Official SDKs for six platforms.

GetFluxly now ships official client libraries for six platforms. Every library wraps the same HTTP API, handles authentication via the x-gflux-key header, and exposes a consistent track/identify/page surface.

• JavaScript (browser) via @getfluxly/browser: auto-captures page views, anonymous identity, and consent; exposes window.gflux.
• React via @getfluxly/react: provider + hooks wrapping the browser SDK with first-class React lifecycle integration.
• Next.js via @getfluxly/next: SSR-safe provider that handles client/server event routing and App Router compatibility.
• Node.js via @getfluxly/node: server-side batch ingest with automatic retry and backoff.
• Python via getfluxly on PyPI: sync and async clients for Django, FastAPI, and script use.
• Ruby via getfluxly on RubyGems: thread-safe background flush with Rack middleware helpers.

Workspace timezone.

Dashboards and timestamps across the Console now render in your workspace timezone instead of raw UTC. Set your preferred timezone once in workspace settings and every chart label, event timestamp, and scheduled time reflects it.

Delete your account or a project.

You can now permanently delete an individual project or your entire account from account settings. Before the operation runs, the Console shows a clear summary of which workspaces will be affected. A full cascade cleanup removes all underlying data once confirmed.

Outbound webhooks and Stripe source.

An outbound webhook delivery pipeline lets you forward GetFluxly events to any HTTPS endpoint. Configure retry behavior, inspect delivery logs, and toggle endpoints on or off per event type. A companion Stripe inbound source connects your Stripe account and runs a one-shot historical backfill of customers, subscriptions, and charges so your profile data is complete from day one.

Durable analytics rollups and write-side hygiene.

Historical analytics queries now hit pre-computed daily rollups instead of scanning raw event rows, so dashboards for longer time windows load significantly faster. Write-side hygiene improvements apply bot detection, spam filtering, and consent-drop counters at ingest time, keeping rollup data clean without a backfill step.

Active-now map shades by traffic.

The live visitor map on the overview now renders as a choropleth: regions shade darker as active visitor count rises. At a glance you can see where traffic is concentrated right now without reading individual pin counts.

The GetFluxly private beta opens Monday, May 25.

After eight months of building in the dark, the GetFluxly private beta opens on Monday, May 25, 2026. Accepted teams get three months of full platform access at no cost, with no card on file. One platform for product events, unified profiles, behavioral segmentation, lifecycle automation, and email send, behind one SDK and one HTTP API.

Full details, FAQ, and the application link are in the launch announcement.

Browser SDK: transport hardening and security tightening.

The browser SDK's 0.4.0 release is a focused hardening pass on the pieces that send events and store identity. The headline fix is in the transport: the old delivery path treated any HTTP response as success so long as the network call resolved, which meant 4xx and 5xx responses were silently dropped and never retried. The transport now inspects response.ok and response.status, retries 408/425/429/5xx with jittered exponential backoff, and surfaces non-retryable rejections through a pluggable logger config. No code changes required; affected workspaces will see ingest completeness climb on the next deploy.

• Keepalive scoped to sendBeacon only. Regular interval flushes used to share the 64KB per-origin keepalive budget and threw under real volume. Standard flushes now use a regular fetch; keepalive is reserved for page-leave delivery via sendBeacon, where it actually matters.
• Remote config response is validated and clamped. /v1/sdk-config responses are no longer trusted blindly. Unknown fields are dropped, invalid enums are rejected, and sampling is clamped to [0, 100]. A compromised or misconfigured config endpoint cannot flip the SDK's privacy defaults out from under the customer.
• Anonymous-id cookie is Secure-flagged on HTTPS. The cookie fallback used by the identity layer now sets the Secure attribute whenever the page is served over HTTPS, so it cannot leak over plain HTTP.
• apiHost validated with new URL(). Non-http(s) protocols are rejected; URLs that already include a path are preserved as-is rather than having endpoint segments concatenated naively. Misconfiguration fails loudly at init instead of corrupting URLs in production.
• Consent banner now respects strict CSPs. Pass consentBanner.nonce or set <meta name="gflux-csp-nonce"> and the injected <style> tag runs under your CSP without needing style-src: unsafe-inline.
• SPA navigation deduplicated. pageview and page-leave previously detected route changes independently and raced; both now subscribe to a single shared SPA router notifier. page-leave fires on SPA navigation in addition to visibility and unload.
• UTM parameters attached to every page_view. Not just session_start.
• Event buffer is now O(1) on push and eviction. A 10,000 event burst into a 200-cap buffer used to balloon CPU; the new ring buffer keeps both operations constant time.
• SDK ships with SECURITY.md and a bundle size budget. Vulnerability disclosure path is now documented and the build fails CI if the published bundle drifts past its agreed ceiling.
• Breaking: gflux.destroy() is now async. Returns a Promise<void>. Fire-and-forget callers still work; callers that need delivery guarantees on teardown can await it to wait for the transport to drain.

Replay automations against any historical profile.

You can now select any profile in the Console, pick an automation, and run it against that user's full event history as if today were a different date. Useful for debugging "why didn't this fire?" and for testing new flows against real cohorts before they go live.

• New Replay tab on every automation, with simulate mode (no real sends).
• Diffs the run against what actually happened in production.
• Replays write to a separate audit log and can be exported as JSON.

Segment counts now update live as you build.

The segment builder used to recompute counts on save. It now streams an estimated count as you add each filter, with the full count finalising in < 2s for most workspaces. Caching is per-workspace, scoped to the current event window.

• Estimated count appears in < 200ms for < 10M-event workspaces.
• Switched the underlying engine from per-query scans to a Bloom-filtered preflight.
• Existing saved segments unchanged, only the build experience is faster.

Identity stitching: fixed a race when identify() runs before init.

If your app called window.gflux.identify() in the same tick as the SDK boot, the identify could land before the SDK had read its anonymous ID from storage, producing an orphan profile. The SDK now buffers identify calls until init has fully resolved.

• No code changes required. Affected workspaces will see orphan-rate drop to ~0.
• If you hit this previously, the Console's Identity links → Resolve tool can merge the orphans.

Live event stream in the Console.

The Events page now has a tail-mode that streams new events as they arrive over a long-lived SSE connection. Default page-load still shows the last 24 hours; press L to switch to live tail.

• Stream is filtered by your current Events filters (event name, profile, anonymous ID, time range).
• Backpressure-safe: pauses the stream automatically if rendering can't keep up.
• Keyboard: L tail, P pause, Esc exit.

HTTP Events API: retry guidance is now explicit.

The HTTP Events API docs now call out that ingest is at-least-once. Server callers should retry 5xx responses with backoff and tolerate duplicate events after unknown network outcomes.

• Backwards compatible. The event payload shape stays the same.
• Recommended pattern: use stable event names and keep backend handlers safe to run more than once.
• Server examples now show short timeouts and background delivery instead of blocking user-facing requests.

API: /v0 endpoints retired.

The /v0 namespace, which has been deprecated since November, is now removed. All endpoints live under /v1. Beta workspaces have already been migrated automatically; if you have client code calling /v0/track, swap the path to /v1/track. The request and response shapes are identical.