diff --git a/mindspace-analytics.mjs b/mindspace-analytics.mjs
index a619d31..f3839e4 100644
--- a/mindspace-analytics.mjs
+++ b/mindspace-analytics.mjs
@@ -95,7 +95,10 @@ export function injectMindSpaceAnalytics(html, {
if (source.includes(ANALYTICS_MARKER)) return source;
const owner = pseudonymizeAnalyticsId(ownerId, config.idSecret);
if (!owner) return source;
- const metadata = { owner_id: owner, owner_segment: String(ownerSegment || 'unknown'), owner_label: resolveAnalyticsOwnerLabel({ displayName: ownerLabel }), page_id: String(pageId || ''), publication_id: String(publicationId || ''), channel };
+ // Public page source must not contain a readable account name. The stable
+ // pseudonym and coarse plan segment are sufficient for page analytics;
+ // readable labels are reserved for server-originated events only.
+ const metadata = { owner_id: owner, owner_segment: String(ownerSegment || 'unknown'), page_id: String(pageId || ''), publication_id: String(publicationId || ''), channel };
const attrs = [
ANALYTICS_MARKER,
`data-website-id="${config.websiteId.replaceAll('"', '"')}"`,
diff --git a/mindspace-analytics.test.mjs b/mindspace-analytics.test.mjs
index 5cc7b00..c3d874b 100644
--- a/mindspace-analytics.test.mjs
+++ b/mindspace-analytics.test.mjs
@@ -49,6 +49,7 @@ test('injects one local same-origin tracker with page dimensions', () => {
const html = 'DemoDemo
';
const out = injectMindSpaceAnalytics(html, {
ownerId: 'user-123',
+ ownerLabel: '张三',
pageId: 'page-1',
publicationId: 'pub-1',
config: {
@@ -65,7 +66,8 @@ test('injects one local same-origin tracker with page dimensions', () => {
assert.match(out, /data-auto-track="false"/);
assert.match(out, /page_id/);
assert.match(out, /owner_segment/);
- assert.match(out, /owner_label/);
+ assert.doesNotMatch(out, /owner_label/);
+ assert.doesNotMatch(out, /张三/);
assert.match(out, /page_click/);
assert.match(out, /page_form_submit/);
assert.match(out, /page_scroll_/);