Conversion Tracking & Attribution

A browser pixel alone is a lossy instrument. It misses conversions to ad blockers, to Safari's Intelligent Tracking Prevention, and to users who close the tab before the tracking beacon flushes. Industry loss rates of 10–30% are ordinary.

The server has the opposite problem and the opposite strength: it cannot see the ad click, but it is the only component that knows authoritatively that an account was created or a report was billed. Neither path is sufficient alone.

Grade My Investments runs both against the Reddit Ads pixel and its Conversions API. The browser reports what it saw; the API reports what actually happened in the database. Where they overlap, Reddit collapses them into one conversion.

The client platform is not a single application. Public marketing pages are statically prerendered, the free stock-grade pages are generated HTML artifacts built on a report VM, and the signed-in product is a Blazor WebAssembly SPA. All three serve from the same origin but are built by different pipelines.

This matters because ad clicks land on the public and SEO pages, while conversions happen in the WASM app. The tracking tag had to be installed in three independent places, and the click id had to survive the crossing.

Because a single-page application only produces one document load, the SPA router subscribes to location changes and reports each in-app navigation explicitly. Without that, the entire signed-in journey would appear as one page view.

When both paths report the same conversion, the ad platform collapses them on a shared conversion id. The obvious implementation — generate a random id in the browser and send it to the server — is fragile: any dropped request silently double-counts revenue, and the failure is invisible in reporting.

Instead the ids are derived from identifiers both sides already hold independently. Nothing has to survive a round trip:

The browser computes the id from the API response; the server computes it from the row it just wrote. They agree by construction.

Third-party cookies are disappearing, so attribution increasingly depends on hashed identity matching. Identifiers are SHA-256 hashed to lowercase hex, but normalization must happen before hashing or the same person produces different digests and never matches.

• Email — trimmed and lowercased, then hashed
• Phone — reduced to digits only, then hashed
• External id — stable OIDC subject, not a database key
• IP — taken from the forwarded-for chain, port stripped

The external id is deliberately the identity-provider subject rather than the internal account id, so it is stable from the first anonymous touch through account creation.

Marketing measurement is the lowest-value work in any request that contains it. The architecture enforces that ordering rather than trusting callers to remember it:

• The client returns false rather than throwing — no tracking failure can propagate
• Server calls are dispatched fire-and-forget; no user waits on an ad network
• Browser helpers degrade to no-ops when the tag is blocked
• Absent credentials disable the whole path, so non-production never writes to live pixels

Transient failures retry with exponential backoff on rate limiting and server errors; client errors do not retry, because a malformed payload will never succeed.

Every tag is an explicit exception to a restrictive default-deny policy. Adding a measurement vendor means widening script-src for its loader and img-src plus connect-src for its collection endpoints — in each host document independently.

A missed directive does not produce an error page. It produces silence: the tag loads, the beacon is blocked, and reporting shows zero conversions with no obvious cause. Verifying the actual network trace after deployment is part of the change, not an optional follow-up.