extstat

Privacy-first, cross-store analytics for browser & IDE extensions. One tiny SDK for installs, active users, and custom events — across Chrome, Firefox, Edge (MV3), VS Code, and Figma.

• Tiny — 2.7 KB minified, ~1.2 KB gzipped. Zero runtime dependencies.
• Cross-store — one SDK for every extension runtime (chrome.storage → localStorage → in-memory).
• Private by design — no personal data, no cookies, no fingerprinting. Honors Do Not Track and a one-line opt-out.
• Resilient — batches events, persists them offline, retries on failure. MV3 service-worker safe.

Install

npm install extstat

Quickstart

In your extension's background script / service worker:

import { init } from "extstat";

const analytics = init({
  apiKey: "esk_your_project_key", // from your extstat dashboard
  endpoint: "https://ingest.extstat.dev/v1/e",
});

analytics.track("install");
analytics.track("feature_used", { feature: "export" });

Create a project to get your API key and endpoint at the dashboard.

API

init(options): Extstat

Creates and returns a client. (new Extstat(options) works too.)

| Option | Type | Default | Description | | --- | --- | --- | --- | | apiKey | string | — | Required. Your project key. | | endpoint | string | hosted collector | Where events are sent — copy yours from the dashboard. | | disabled | boolean | false | Disable all collection. | | respectDoNotTrack | boolean | true | Collect nothing when the browser sets Do Not Track. | | flushIntervalMs | number | 15000 | How often the queue is flushed. | | maxQueue | number | 20 | Flush early once this many events are buffered. |

analytics.track(name, props?)

Record an event. props is an optional flat object of string | number | boolean | null. Safe to call before the client finishes booting.

analytics.flush()

Send all buffered events immediately (e.g. before teardown).

Privacy

extstat stores only a random, locally-generated client id (not a fingerprint), the event name, optional properties you choose, and a timestamp — no IP addresses, cookies, or cross-site identifiers. It honors Do Not Track, and init({ disabled: true }) opts out entirely. Don't put personal data in event names or properties; you remain the data controller for whatever you send. See the privacy posture.

License

MIT