Burnpedia Image Save Button Analytics

Burnpedia Image Save Button Analytics is not affiliated with, endorsed by or
sponsored by Pinterest, Inc. Pinterest is their trademark, named here only to
say where the button saves to.

A reader is looking at a photograph in your post and would happily save it to
Pinterest. Most of the time nothing on the page invites them to, so they scroll
on.

This plugin puts a small save button on the images in your posts. It is an
image hover button: point at a picture and it fades in, press it and Pinterest’s
own save window opens with your image, your headline and a link back to the post
already filled in.

It also counts the presses, so you can see which of your images readers
choose to save.

How Burnpedia Image Save Button Analytics is different

• It is light and steps aside: one deferred script with no jQuery; the
  button is drawn over your images, never wrapped around them, and all it adds
  to a post’s markup is an empty marker, plus your hidden Pin image if you set
  one; and no second button when Pinterest’s own pinit.js is on the page.

What you get

• A save button on every content image — on hover on a desktop, always
  visible on a phone or a tablet.
• A private count of every press, per post, for the last 30 days and for all
  time, with a 30-day trend line.
• And which image, not just which post. Open Saved images under any post
  to see each picture with a thumbnail and its own count — on a roundup, which of
  the six photographs readers actually want.
• The right file gets saved. WordPress serves several sizes of every image;
  the button always hands over the largest one, not the small copy a phone
  happened to download.
• You choose what the description says. A box in the post editor sets the
  Pin description for every image in that post, instead of alt text meant for a
  screen reader. Leave it empty and the alt text is used, exactly as before.
• A hidden Pin image, if you make one. Attach a tall image built for Pinterest
  and the save button hands Pinterest that picture instead of the photograph the
  reader pressed. Nobody sees it on the page. One per post, or none.
• A list of the images with no alt text. Without it, a saved Pin is described
  with the post’s title, so every photograph in that post carries the same
  sentence. The Analytics screen lists those posts, most saved first, with a link
  to each — from the day you install it, reading only your own posts.
• Which day of the week readers save. The Analytics screen shows the average
  saves for each weekday and, once there is enough to go on, names the day your
  readers save most.
• A “Most saved images” block. Add it to any page or sidebar and it shows
  the images on your site that readers saved most, each linking to its post.
  Nothing appears anywhere until you add the block.
• Download your counts as a CSV file for a spreadsheet: every post and
  image with a save, not just the ones on screen.
• Respects Do Not Track and Global Privacy Control. A reader whose browser
  asks not to be tracked is not counted. The button still works for them.
• Shop product pages, if you want them. If your site has shop products, the
  settings screen offers to put the button on the main product photos. It stays
  off until you choose it.
• One setup for a multisite network. A network administrator can set the
  button up once for every site, and optionally stop sites changing it.
• It stays out of the way — it never appears on icons, avatars or emoji, it
  skips anything with the class no-save, and it respects Pinterest’s own
  data-pin-nopin attribute.

Nothing here is locked

The button, the counting and the analytics screen are free. Not a trial, not a
limited number of posts, not a watermark. No account is needed, and nothing is
sent anywhere unless you ask for it or save an API key, which also shares your
daily save totals unless you untick Share your click counts (every case is
listed under External services).

The optional extra, and where it comes from

Everything above is the whole plugin. One further feature is optional, and it
needs an account with our own service, Burnpedia — a
Pinterest scheduling and analytics tool we run.

Paste an API key from
burnpedia.app into Save Button →
Account and the Analytics screen gains Pinterest analytics for your own
Pins to those same posts — impressions, saves and outbound clicks.

A free Burnpedia account shows the site-wide total of those three numbers.
The per-post columns — which of these posts your Pins earn on — are on
Burnpedia’s paid plans; the screen says so and links to them. Getting the key
is free either way, and one press connects this site without copying it.
Without a key the plugin makes no outbound request except the one-press
connection, the install count if you switch it on, a bug report you send, or the
More plugins list you open — each only when you choose it — and nothing on the
screens above changes. Exactly what is sent, and when, is listed under External
services below.

Privacy

No visitor data is collected: no IP address is stored; rate limiting keeps only a
short-lived salted hash that cannot be read back to an address, deleted by the
next save a reader makes in a later minute. There is no cookie, no user agent,
no referrer and no profile — only a number per post, a number per day, and
a number for each image on a post, identified by a code worked out from the
image’s own web address.

External services

This plugin is a client for Burnpedia (https://burnpedia.app), a Pinterest
scheduling service we operate. Its main use is one optional feature: the
three extra columns on the Analytics screen showing how your own Pins for these
posts perform. The optional install count and a bug report you send also go to
Burnpedia, each described below.

Nothing is sent anywhere unless you ask for it or save an API key. With no
API key saved and the install count switched off — which is how the plugin
arrives — requests leave this site only after you press Connect this site to
Burnpedia, when you send a bug report, or when you open the More plugins
list (all three below). Nothing happens
on activation, and nothing on a visitor’s page view. There is no third-party
advertising, no offer outside the plugin’s own screens and its box in the post
editor, and no third-party script or style: every script and style in this
plugin is served from your own site (the More plugins screen shows each
plugin’s icon from WordPress.org, as Plugins → Add New does), and the click
counter talks to your own site and nothing else.

No request to Burnpedia carries your site’s address in its headers: each
one sets its own User-Agent (WordPress’s default one names the site). The More
plugins list is not one of them: WordPress fetches it itself, through
plugins_api() as Plugins → Add New does, with that default User-Agent.
Where a request does send this website’s address, the list below says so.

There are two separate things you can switch on, an API key and the install
count, and neither is on by default.

Connecting this site in one press (optional). On the Account screen you
can press Connect this site to Burnpedia instead of copying an API key by
hand. It is one of the requests that can happen before a key exists (with the
install count, a bug report and the More plugins list), and it starts only
when an administrator presses that button:

• Your browser opens https://burnpedia.app/connect/wordpress when you press
  Open burnpedia.app to approve, carrying this site’s address and its title,
  so the approval screen can name the site you are about to connect. It also
  carries a random one-time request ID and a fingerprint of a secret your
  browser never sees.
• From the moment you press Connect this site to Burnpedia, while the
  Account screen is open, your site asks
  POST https://burnpedia.app/api/site-connect/claim every few seconds whether
  you have approved it there (at least three seconds apart, and at most 100
  times each time that screen is opened while the request is live), and once
  each time you press I have approved it. Each ask sends that request ID and
  the secret, and names the plugin and its version in its headers; it does not
  carry your site’s address, not even in its User-Agent header. Once you
  approve, the answer is an API key, saved for you and never shown in your
  browser.
• The request expires after fifteen minutes and its key can be collected only
  once. If you press Cancel or deny it, or the request expires, the asking stops
  and no key is created.
• You never have to use it: pasting a key by hand still works.

The reader-click counting itself contacts nobody. With a key saved, its
daily totals are shared with Burnpedia unless you untick Share your click
counts (below).

When a key is saved, it adds these requests, and only these:

• GET https://burnpedia.app/api/v1/me — when an administrator opens the
  Analytics screen (an answer is reused for five minutes), right after a key is
  saved or collected or the Account settings are saved, and when an
  administrator presses Check connection. Sends: your API key. Receives: your
  plan, and whether a Pinterest account is connected.

• GET https://burnpedia.app/api/v1/analytics/site — when an administrator opens
  the Analytics screen (an answer is reused for fifteen minutes). Sends: your API
  key and this website’s domain name.
  Receives: impressions, saves and outbound clicks for the Pins you published
  through Burnpedia for this website, over the last 30 days.

• POST https://burnpedia.app/api/v1/events/save-clicks — at most once every
  twelve hours, when an administrator opens the Analytics screen. Sends: your API
  key, this website’s address, and how many times readers pressed Save on each of
  the last 90 days — a date and a whole number, nothing else. Receives: how many
  days were recorded. It puts those counts beside your Pin results in your
  Burnpedia dashboard. Nothing about any reader is in it. The plugin stores
  no IP address, no user agent, no referrer and no cookie, so there is nothing
  about a visitor for it to send. Share your click counts is ticked by
  default; untick it under Save Button → Account and the counts never leave
  your server.

The install count (optional, off by default). WordPress.org does not tell
plugin authors how many sites run their plugin. The plugin asks you once, in a dismissible notice,
and you can change the answer at any time under Save Button → Account.
Saying no sends nothing and closing the box without answering also sends
nothing. If you switch it on, this site sends a short report:

• POST https://burnpedia.app/api/plugin-insights — once when you switch it on,
  then at most once a week while an administrator is using wp-admin, once if you
  deactivate the plugin, and once if you delete it. Sends exactly nine things: a
  random ID generated on this site, which plugin and which version, which of
  those four events it is, your WordPress version, your PHP version, your site
  language, whether this is a multisite network, and whether an API key is saved
  (true or false — never the key). Receives: nothing your site uses.

No install-count report carries your website address, not even in the
User-Agent header: the plugin sends its own. The random ID is made up on your server and means
nothing outside it. Switch the setting off and the ID is deleted, so counting
stops and a later change of mind cannot be joined to it. It is off until you
choose it, no feature depends on it, and nothing about any reader or any logged-in
user is in it.

Report a bug and More plugins (only when you use them). Pressing Send
report on Save Button → Report a bug sends
POST https://burnpedia.app/api/plugin-bug-report: your description, an optional
reply email, the plugin, WordPress and PHP versions, theme, language, whether it is
multisite and whether a key is saved (never the key) — and your site’s address
only if you leave “Include this site’s address” ticked (it starts ticked; untick
it and the address is not sent, not even in the request’s headers). Opening
Save Button → More plugins asks WordPress.org (https://api.wordpress.org/plugins/info/) for
our plugin list via WordPress’s plugins_api(), as Plugins → Add New does.
The list is kept for twelve hours (fifteen minutes after a failed try), and
opening the screen again in that time does not ask for it again. On that screen
your browser shows each plugin’s icon from WordPress.org, and More Details
and Install Now are WordPress’s own plugin details and installer, which
fetch from WordPress.org when you press them.

Apart from the connection page your own browser opens, every request to
Burnpedia above is made from your server, and a visitor reading your site can
never cause one. Each happens when an administrator acts in wp-admin (the
connection’s asks run while the Account screen waits for your approval), or
when the plugin is deactivated or deleted (which a host’s tools or WP-CLI can also
do), and each names the plugin and its version, in a header or in its body. The
More plugins list is WordPress’s own request.

Burnpedia’s terms: https://burnpedia.app/terms
Burnpedia’s privacy policy: https://burnpedia.app/privacy

Pinterest itself is never contacted by this plugin. The save button opens
Pinterest’s own save dialog in the visitor’s browser when the visitor clicks it,
exactly like following a link; that link carries the image’s address, the post’s
address and the Pin description, which is what the saved Pin is made of. The
plugin sends nothing to Pinterest and loads nothing from it.

Burnpedia is our own service and is not affiliated with Pinterest, Inc.