A measurement script that answers one question: which visits to your site came from an AI answer engine, and which of those became an enquiry.
You are probably here because you found this hostname in a script tag and want to know what it does. Good. This page is the whole answer, and the script itself is unminified and readable — about 200 lines, most of them comments. There is no build step between our repository and the file your visitors run, so what you audit is byte-for-byte what executes.
| Collected | Never collected |
|---|---|
| Page path — no query string, no fragment | Names, emails, phone numbers or message text in readable form |
document.referrer hostname only | The full referring URL, which can carry a search query or a private path |
utm_* parameters your own links set | Cookies. There are none. |
A random session id in sessionStorage, gone when the tab closes | Cross-site identifiers, fingerprints, canvas or font probing |
| Coarse device class: mobile / tablet / desktop | Keystrokes, clipboard, page content, form field values |
| Enquiry type: form · call tap · WhatsApp tap · email click | Anything that could follow a person off your domain |
If a submitted form contains an email or phone field, we compute a SHA-256 digest inside your visitor's browser and send only that. It is not reversible, it is not joined to anything, and it exists for exactly one purpose: so a double-tapped submit button is not counted as two enquiries.
Nothing is collected or transmitted until one of these is true:
<script ... data-consent="granted"> <!-- attribute on the tag -->
cited('consent', true); // or your own consent code
cited('consent', false) stops collection and clears the session id. This is the posture the
India DPDP Act 2023 expects: consent informed, specific, granular and affirmative, with
third-party scripts blocked until it is recorded.
script-src https://tag.getcited.in connect-src https://api.getcited.in
Every published version has a Subresource Integrity hash you can pin. Current hashes are always at /integrity.json.
<script async src="https://tag.getcited.in/t/v1.0.1/c.js" integrity="sha384-UGw39E4DTAkSoRIkjb1VVkWTjx85mRn1376EOcuiduw++orB1xd7gLtSApQSRKjK" crossorigin="anonymous" data-brand="YOUR_BRAND_KEY"></script>
A published version is never rewritten. Not for a typo, not for a hotfix. Changes ship as a new version directory, so a hash you pin today keeps working.
That promise would be worth nothing resting on discipline, so it is enforced in CI: a lock file records each version's hash at first publication and the build fails if any published version's bytes ever differ. A published SRI hash that can silently change is worse than no hash at all — it invites you to depend on a promise we are not keeping.
If you have no IT function and would rather the tag update itself, use
https://tag.getcited.in/stable/c.js and omit the integrity attribute. You trade
verifiability for convenience. That is a documented choice, not an accident — but the pinned version is what
we recommend.
Requirements 6.4.3 and 11.6.1 have been mandatory since 31 March 2025 and cover every third-party script on a payment page. Paste this:
Script: Cited tag (tag.getcited.in)
Justification: First-party measurement of which AI-answer-engine referrals
produce enquiries. Collects page path, referrer hostname and
enquiry type. Transmits no cardholder data and no readable
personal data.
Integrity: Subresource Integrity hash pinned to an immutable versioned
URL; hash published at https://tag.getcited.in/integrity.json
| Version | Notes |
|---|---|
v1.0.1 — current | Sends the beacon as text/plain rather than application/json. Only the three CORS-safelisted content types avoid a preflight, and a beacon that needs a preflight is dropped silently. The body is still JSON. |
v1.0.0 | Initial release. Still served, still pinnable, never rewritten — but v1.0.1 is what you want. |
Both remain available at their original URLs with their original hashes. That is the point: a version you pinned keeps working.
| Loading | async; never participates in page load, never blocks window.onload |
| Failure mode | Every entry point wrapped in try/catch — fails silently rather than throwing on your page |
| Globals | Exactly one: window.cited. No prototypes patched, nothing else touched |
| Network | navigator.sendBeacon on visibilitychange. No synchronous XHR, no unload handlers |
| Private mode | Degrades rather than breaks when sessionStorage is unavailable |
| Misconfiguration | Does nothing at all without a data-brand key |
| Size | 4.3 KB gzipped, comments and all |