How Pixelary works

1. The script loads

Your site loads https://cdn.pixelary.app/s/<site key>.js. The file holds the Pixelary SDK and your site’s public settings: which pixels are connected, your triggers and your consent defaults. Tokens and keys never go into it.

The file is cached for about five minutes. When you change something in the dashboard, the site picks it up within that time, without republishing.

2. A trigger fires

Pixelary turns what happens on the page into events:

• page views, including navigation in single-page sites (Framer, Next.js, Lovable);
• form submissions, sent as Lead;
• clicks on elements you choose, page URLs, scroll depth;
• bookings in Calendly, Cal.com, Typeform, Tally and HubSpot embeds;
• your own calls to the JavaScript API or Google Tag Manager.

3. Consent decides what may go out

Before anything leaves the page, Pixelary checks the visitor’s consent. Pixels load only with ad_storage; customer data and the server copy need ad_user_data. An event that happens before the visitor answers waits on the page, and goes out with its original time if they accept. Consent & banners

4. Two copies, one event ID

Every event gets one event_id. The browser pixel sends it as eventID; our server sends the same value through the Conversions API. The platform sees two reports of one conversion and keeps one. If an ad blocker stopped the pixel, the server copy still arrives.

Email, phone and the other customer fields are normalized and hashed with SHA-256 in the visitor’s browser, separately for each platform, because Meta, TikTok and OpenAI use different rules. Raw values never reach our servers.

5. The server checks and sends

• The event must come from one of your site’s domains. Events from other domains are ignored.
• Events from staging addresses (such as *.framer.app or *.webflow.io next to your own domain) go out in test mode only, so tests stay out of your ad reports.
• Headless browsers, crawlers and scripts are filtered out.
• Each paid plan includes 1 million server events per site per calendar month. Above that, server-side PageViews are only counted; conversions are always sent. Browser pixels are never limited.

6. The event log

On paid sites every server event lands in the event log: what was sent, to which platforms, under which consent, and each platform’s response. It names the customer fields that were sent, never their values, and masks anything in your custom data that looks like an email or a phone number. The log keeps 30 days, or 90 days on the 10-site plan.