Problem
DNT/GPC signals are ignored entirely — a repo-wide search for doNotTrack / navigator.dnt / globalPrivacyControl / Sec-GPC returns nothing. The tracker (routes/analytics.ts:601-640) sends unconditionally.
Why it matters (privacy-first)
Simple Analytics is the only strict competitor that documents honoring DNT (it drops data entirely) and markets it. Cheap to add and a purity flex none of Plausible/Fathom/Umami claim. (Their counter-argument — "we collect no PII so it is moot" — is valid, so this is opt-in-to-respect, not mandatory.)
Proposed fix
Have the tracker no-op when navigator.doNotTrack === "1" or navigator.globalPrivacyControl === true, and/or honor the Sec-GPC: 1 request header server-side in /collect. Make it a config toggle.
Priority: P2 (marketing/positioning win).
From the 2026-07-20 privacy-first competitive audit (vs. Plausible / Fathom / Simple Analytics / Umami).