Server-side tracking explained

Convultra captures conversion data on the server, removing the dependency on client-side pixels. Server-side matching reaches about 98%, against pixels that miss 30 to 40% of conversions. This page is the technical view; for the plain-English version see How Convultra works.

How it works

1. A visitor arrives with a click ID

When a user clicks an ad, the platform appends a click ID to the destination URL. Convultra recognizes these automatically:

2. The SDK stores the click ID server-side

The SDK reads the click ID from the URL on the first pageview and sends it to Convultra, which persists it server-side for 90 days against the visitor ID. The visitor ID is a first-party cookie, _cvl_vid, that the SDK writes on your domain, with a backup copy in localStorage. The browser keeps its own 90-day click history too, which the SDK sends with each conversion.

The server-side store holds gclid, fbclid, msclkid and oppref. gbraid and wbraid persist in the browser’s click history only.

The click itself is safe on the server whatever the browser does. Matching a later conversion to it depends on the visitor ID still being in the browser, which it is:

• after the browser restarts;
• when a Safari visitor comes back within 7 days of their last visit, because the SDK renews the cookie on every visit;
• when the visitor clears cookies but not other site data, because the SDK restores the ID from its localStorage copy.

If the cookie and its backup are both gone, for example after more than 7 days away in Safari, after clearing all site data, with a blocker that stops both being stored, or once a private window is closed, Convultra falls back to matching a browser fingerprint (a hash of user agent, language, screen size, time zone and canvas rendering), which is a lower-confidence match. See Click ID persistence.

3. A conversion occurs

When you call a tracking method such as Convultra.trackPurchase(), the SDK sends the conversion to Convultra with the visitor ID, the fingerprint and the browser’s click history. The server looks up the clicks stored for that visitor ID, or for the fingerprint when the visitor ID finds none, and merges them with the browser’s history.

4. The conversion is forwarded

Convultra forwards the conversion, with the click ID and any enhanced user data, to each connected ad platform through its server-side API:

• Google Ads: Google Ads API conversion upload. Live.
• OpenAI Ads: Conversions API. Live.
• Meta: Conversions API. Coming soon.
• Microsoft Ads: Offline Conversions API. Coming soon.
• TikTok: Events API. Coming soon.

Safari ITP and privacy fallbacks

Safari ITP limits first-party cookies to 7 days, and to 24 hours in some cases. When ITP strips or prevents gclid storage, Google provides two privacy-safe alternatives:

• gbraid for iOS app-related click tracking
• wbraid for web campaign clicks on iOS and Safari

Convultra captures all three and uses whichever is available. If gclid is present it takes priority; otherwise gbraid or wbraid is used.

What the SDK collects automatically

On every pageview, with no extra code:

• Page URL and referrer
• Click IDs (gclid, gbraid, wbraid, fbclid, msclkid, ttclid, oppref)
• UTM parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term)
• Session and visitor identifiers
• Device, browser, OS and screen resolution
• Geolocation (country, region and city, derived from IP on the server)

SDK performance

The recommended install uses a stub plus async script, so tracking calls are queued immediately and processed once the SDK loads. See Installing the tracking script.

Sending events from your own server

A conversion that happens outside the browser, such as an order confirmed by a payment webhook or a lead qualified in a CRM, can be sent by posting to the tracking endpoint directly. It is the same endpoint the SDK uses:

POST https://tracking.convultra.com/v1/track
Content-Type: application/json
X-Convultra-Key: proj_your_project_key

{
  "project_id": "proj_your_project_key",
  "event_id": "order_8842",
  "event_type": "purchase",
  "timestamp": 1736951400000,
  "value": 149.99,
  "currency": "USD",
  "visitor_id": "vid_1736950000000_k2x9m4q7w1ab",
  "data": { "orderId": "order_8842" },
  "user_data": { "email": "sarah@example.com" }
}

project_id is your project key, the same proj_ value the script uses. event_type is one of the seven conversion types or a custom name. Give every event a unique event_id so a retried webhook is deduplicated rather than counted twice. user_data is optional; when present, Convultra normalizes and hashes it before anything is forwarded (see Enhanced conversions). To send several events in one request, post a JSON array to /v1/track/batch.

visitor_id is optional: the value of the _cvl_vid cookie the SDK set when the visitor landed. It links the server event to the clicks Convultra stored for that visitor. A handler serving the visitor’s own request, such as a form submission, can read it from the request’s cookies; for a later webhook, save it with the order or lead when it is created.

A server-sent event has no browser context, so the visitor_id is what joins it to a stored click. Without one, Google Ads receives only the hashed user_data, as an enhanced conversion. The WordPress plugin posts WooCommerce purchases to this endpoint from your server.

Architecture

Browser                         Convultra server                  Ad platforms
-------                         ----------------                  ------------
1. User clicks ad
   (URL contains gclid)

2. Page loads SDK ----------->  Stores click ID server-side

3. Convultra.trackPurchase() -> tracking.convultra.com/v1/track
                                 +- Matches click ID ---------> Google Ads API (live)
                                 +- Adds hashed user data ----> OpenAI Ads API (live)
                                 +- Deduplicates -------------> Meta, Microsoft Ads, TikTok (coming soon)

Server-side forwarding means conversions reach ad platforms even when the visitor’s browser blocks third-party requests, cookies or JavaScript.