Install Cortality in about ten minutes.

Sign in at app.cortality.com. The setup screen shows your siteId and the tag, ready to paste. If you don't have an account yet, email colton@cortality.com; we typically set it up the same day.

Paste this immediately before your page's closing </body> tag, using the siteId from your setup screen:

<script src="https://cdn.cortality.com/c.js" async></script>
<script>
  window.addEventListener('load', function () {
    if (window.Cortality) {
      Cortality.init({
        siteId: 'op_yourcompany',
        endpoint: 'https://ingest.cortality.com/v1/sessions'  // stated explicitly so installs never depend on defaults
      });
    }
  });
</script>

If anything mangles the copy-paste, the two hostnames are cdn.cortality.com (script) and ingest.cortality.com (endpoint).

Prompt for AI site builders

If your site is built and edited through an AI tool, paste this to it, with your real values substituted:

Add Cortality analytics. In index.html, immediately before the closing
body tag, add exactly this, and do not wrap it in a React component,
useEffect, or any loader:

<script src="https://cdn.cortality.com/c.js" async></script>
<script>window.addEventListener('load',function(){if(window.Cortality){
Cortality.init({siteId:'YOUR_SITE_ID',
endpoint:'https://ingest.cortality.com/v1/sessions'});}});</script>

Then add the attribute data-cortality-conversion to our primary
call-to-action button, passing it through to the real DOM element.
If index.html or hosting config sets a Content-Security-Policy, add
https://cdn.cortality.com to script-src. Do not modify the snippet
in any other way.

1. Open your site in a normal browser window.
2. Right-click → Inspect → Console.
3. Look for: [Cortality] session started

If the message doesn't appear

• A CSP error in the console mentioning cdn.cortality.com → see Content Security Policy.
• No error at all → the tag likely isn't in the served HTML. View source and search for cortality; if it's missing, the change didn't deploy.
• [Cortality] path not in allowedPaths → working as configured; you're on a route outside your allowlist.
• Anything else → email colton@cortality.com; we answer same-day.

Add one attribute to the element that counts as the win on your page: the form submit button, the booking button, the sign-up link.

<button data-cortality-conversion>Request a Demo</button>

In React and similar frameworks, make sure the attribute reaches the real DOM element. On a plain <button> it passes through automatically; on a custom component, the component must spread extra props onto its underlying element. On visual builders (Webflow, WordPress page builders), use the element's custom-attribute setting; if your builder doesn't expose one, tell us which button is the win and we'll suggest the cleanest alternative for your setup.

Single-page applications serve everything from one index.html, so a root-level tag would execute on every route, including logged-in product areas. If your app has authenticated routes, restrict collection to your public marketing routes with allowedPaths:

Cortality.init({
  siteId: 'op_yourcompany',
  endpoint: 'https://ingest.cortality.com/v1/sessions',
  allowedPaths: ['/', '/pricing', '/about', '/blog/*']
});

The behavior is fail-closed in both directions:

• Landing outside the list (a deep link into the app, a bookmark, a login page): the snippet initializes nothing. No session, no listeners, no collection.
• Navigating from a listed route into an unlisted one (marketing page → logged-in app): the snippet sends what it collected on the marketing page, then permanently stops all collection for the rest of that browser tab's life. It does not re-arm if the visitor returns to a marketing route.

How it detects navigation: the snippet monitors the browser's history API (pushState, replaceState, and back/forward), which is how SPA routers change routes without reloading, so client-side route changes are caught without any integration work in your router.

Matching rules: entries are pathnames. Exact entries match exactly (trailing slashes tolerated). A trailing * matches a whole section: '/blog/*' covers /blog and every post under it. Anything not listed is out of scope by default, so new product routes are excluded without you maintaining a blocklist.

Programmatic stop

Belt and suspenders for auth boundaries or consent controls: calling Cortality.disable() immediately and permanently stops collection for the tab and sends what the current page has collected. Call it from your sign-in handler if you want a hard guarantee independent of routing:

onLogin() {
  window.Cortality && Cortality.disable && Cortality.disable();
}

Mark any element with data-cortality-ignore and it is excluded from observation, along with everything inside it:

<div data-cortality-ignore>
  <!-- live chat widget -->
</div>

Use this for anything that renders visitor-entered or personalized content outside a form field. Automatic masking covers form input values everywhere, but content your page renders elsewhere, a live-chat transcript, a "welcome back" banner, a quote-calculator result, is page content and will be captured unless you exclude it. Chat widgets are the most common case, and they are yours to mark, including any you add later. See the masking model for exactly what is and isn't covered automatically.

If your site sends a Content-Security-Policy header, two directives matter:

One subtlety: the capture module fetches your page's images to include them in page captures. If your images are served from a different origin (a CDN or image host), that origin needs to be in connect-src too, unless https: is already allowed. If you're not sure where your CSP is configured, it's usually your hosting config or server middleware; send us the header and we'll tell you the exact change.

Your dashboard lives at app.cortality.com. Sign in with your email. Use "Forgot password?" to reset your password. Invite teammates from Settings; each login sees only the sites it belongs to. Sessions typically appear within about a minute of a visit ending. The dashboard shows your page section-by-section with attention scores, your conversion funnel, and the current recommendations; your written reports are built from the same data.

The short version: mouse, scroll, touch, and click behavior with page coordinates; periodic images of the page as the visitor's browser rendered it; a sanitized copy of the page's HTML; and basic session context. No cookies, no keystrokes, no form values. Linking a visitor's visits is off by default; a site can turn it on for purchase attribution, using a random ID in browser local storage. The standard tag never uses the camera; gaze measurement is a separate module that loads only on sites that opt in.

The complete, versioned statement, including the masking model and its limits, IP handling, retention, and subprocessors, lives in the Trust Center. That page is the authoritative reference; this section is only a summary.

Remove the two script tags. Collection stops immediately. No cookies were set, and the crash-protection buffer in visitors' browsers clears itself. If your site turned on visit linking, that random ID stays in visitors' local storage but is no longer read. Data already collected is kept as described in Retention.