Adds the Umami session recorder (recorder.js) that powers heatmaps, next to the existing analytics tracker in the root layout.
Notes
Loaded via next/script (strategy="afterInteractive"), matching the existing tracker rather than a bare <script defer>.
Carries the same data-domains guard as the main tracker (schoolcompare.co.uk,www.schoolcompare.co.uk) so it only fires on the production hostnames — staging runs the same image under a different host and must not pollute the heatmap/session data.
Cookieless:recorder.js uses Umami's server-side session model (no cookie or local storage written to the device), so it adds no new PECR cookie-consent trigger. (As discussed: cookieless ≠ automatically consent-free under GDPR — worth a line in the privacy policy, but no banner/cookie is required for this to run.)
## Summary
Adds the Umami **session recorder** (`recorder.js`) that powers heatmaps, next to the existing analytics tracker in the root layout.
## Notes
- Loaded via `next/script` (`strategy="afterInteractive"`), matching the existing tracker rather than a bare `<script defer>`.
- Carries the **same `data-domains` guard** as the main tracker (`schoolcompare.co.uk,www.schoolcompare.co.uk`) so it only fires on the production hostnames — staging runs the same image under a different host and must not pollute the heatmap/session data.
- **Cookieless:** `recorder.js` uses Umami's server-side session model (no cookie or local storage written to the device), so it adds no new PECR cookie-consent trigger. (As discussed: cookieless ≠ automatically consent-free under GDPR — worth a line in the privacy policy, but no banner/cookie is required for this to run.)
## Testing
- `tsc --noEmit` and `next build` — clean.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_0146VHeLAWjDVE2B5uU67jCB
Adds the Umami session recorder (recorder.js) that powers heatmaps,
alongside the existing analytics tracker. Loaded via next/script with
the same data-domains guard as the main tracker so it only fires on the
production hostnames — staging runs the same image under a different
host and must not feed the heatmap.
Cookieless: recorder.js uses Umami's server-side session model (no
cookie or local storage on the device), so it adds no new PECR
consent trigger.
Verified with tsc --noEmit and next build.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0146VHeLAWjDVE2B5uU67jCB
tudor
merged commit 7e3096c881 into main2026-07-21 15:06:04 +00:00
This PR adds Umami's session-recorder/heatmap script alongside the existing analytics script.js, gated with the same data-domains hostname restriction so it only fires on production. The change is mechanically simple but introduces a session-replay tracker with no accompanying consent mechanism anywhere in the codebase.
🔴 Severe (blocks merge)
nextjs-app/app/layout.tsx: The new recorder.js session-replay script loads unconditionally for every visitor on every page (via the root layout), with no cookie/consent banner or opt-in gate found anywhere in the repo. It will capture user interactions including the school-search/postcode input (SchoolSearchModal.tsx) and other form fields. Session recording is non-essential tracking under UK PECR/GDPR and capturing postcodes (personal data) without consent is a compliance and data-leak risk to a third-party analytics vendor.
## 🤖 AI Code Review (Claude Code)
This PR adds Umami's session-recorder/heatmap script alongside the existing analytics script.js, gated with the same data-domains hostname restriction so it only fires on production. The change is mechanically simple but introduces a session-replay tracker with no accompanying consent mechanism anywhere in the codebase.
### 🔴 Severe (blocks merge)
- **nextjs-app/app/layout.tsx**: The new recorder.js session-replay script loads unconditionally for every visitor on every page (via the root layout), with no cookie/consent banner or opt-in gate found anywhere in the repo. It will capture user interactions including the school-search/postcode input (SchoolSearchModal.tsx) and other form fields. Session recording is non-essential tracking under UK PECR/GDPR and capturing postcodes (personal data) without consent is a compliance and data-leak risk to a third-party analytics vendor.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Adds the Umami session recorder (
recorder.js) that powers heatmaps, next to the existing analytics tracker in the root layout.Notes
next/script(strategy="afterInteractive"), matching the existing tracker rather than a bare<script defer>.data-domainsguard as the main tracker (schoolcompare.co.uk,www.schoolcompare.co.uk) so it only fires on the production hostnames — staging runs the same image under a different host and must not pollute the heatmap/session data.recorder.jsuses Umami's server-side session model (no cookie or local storage written to the device), so it adds no new PECR cookie-consent trigger. (As discussed: cookieless ≠ automatically consent-free under GDPR — worth a line in the privacy policy, but no banner/cookie is required for this to run.)Testing
tsc --noEmitandnext build— clean.🤖 Generated with Claude Code
https://claude.ai/code/session_0146VHeLAWjDVE2B5uU67jCB
🤖 AI Code Review (Claude Code)
This PR adds Umami's session-recorder/heatmap script alongside the existing analytics script.js, gated with the same data-domains hostname restriction so it only fires on production. The change is mechanically simple but introduces a session-replay tracker with no accompanying consent mechanism anywhere in the codebase.
🔴 Severe (blocks merge)