diff --git a/web/app/[locale]/(landing)/tracked-link.tsx b/web/app/[locale]/(landing)/tracked-link.tsx
index f979b50b41c4..4f019df97d3b 100644
--- a/web/app/[locale]/(landing)/tracked-link.tsx
+++ b/web/app/[locale]/(landing)/tracked-link.tsx
@@ -1,7 +1,7 @@
 "use client";
 
-import posthog from "posthog-js";
 import { Link, usePathname } from "@/i18n/navigation";
+import { captureAnalyticsClick } from "../../lib/analytics";
 
 // Localized internal link that records a PostHog click event, so we can see how
 // many clicks each guide / landing page gets and where they came from.
@@ -21,7 +21,7 @@ export function TrackedLink({
     <Link
       href={href}
       className={className}
-      onClick={() => posthog.capture(event, { target: href, from: pathname })}
+      onClick={() => captureAnalyticsClick(event, { target: href, from: pathname })}
     >
       {children}
     </Link>
diff --git a/web/app/[locale]/components/download-button.tsx b/web/app/[locale]/components/download-button.tsx
index 518e0f889327..26ea7afd8e50 100644
--- a/web/app/[locale]/components/download-button.tsx
+++ b/web/app/[locale]/components/download-button.tsx
@@ -2,9 +2,9 @@
 
 import { Menu } from "@base-ui-components/react/menu";
 import { useTranslations } from "next-intl";
-import posthog from "posthog-js";
 import { useState } from "react";
 import { Link, usePathname } from "../../../i18n/navigation";
+import { captureAnalyticsClick } from "../../lib/analytics";
 import {
   DOWNLOAD_CONFIRMATION_HREF,
   DOWNLOAD_CONFIRMATION_PATH,
@@ -91,7 +91,7 @@ export function DownloadButton({
     "group flex items-center justify-center hover:bg-background/[0.04] dark:hover:bg-background/[0.03] data-[popup-open]:bg-background/[0.04] dark:data-[popup-open]:bg-background/[0.03]";
 
   const captureMac = () =>
-    posthog.capture("cmuxterm_download_clicked", { location, platform: "mac" });
+    captureAnalyticsClick("cmuxterm_download_clicked", { location, platform: "mac" });
 
   // The Apple mark artwork has an 814:1000 aspect ratio. Derive the box width
   // from its height so the glyph fills the frame instead of letterboxing inside
@@ -194,7 +194,7 @@ export function DownloadButton({
                 <Menu.Item
                   render={<Link href="/ios" target="_blank" rel="noreferrer" />}
                   onClick={() =>
-                    posthog.capture("cmuxterm_download_clicked", {
+                    captureAnalyticsClick("cmuxterm_download_clicked", {
                       location,
                       platform: "ios",
                     })
@@ -214,7 +214,7 @@ export function DownloadButton({
                     <Menu.Item
                       key={platform}
                       onClick={() => {
-                        posthog.capture("cmuxterm_waitlist_opened", {
+                        captureAnalyticsClick("cmuxterm_waitlist_opened", {
                           location,
                           platform,
                         });
diff --git a/web/app/[locale]/components/faq-platform-answer.tsx b/web/app/[locale]/components/faq-platform-answer.tsx
index e8a52c8f0a71..dcaa1ca08319 100644
--- a/web/app/[locale]/components/faq-platform-answer.tsx
+++ b/web/app/[locale]/components/faq-platform-answer.tsx
@@ -1,8 +1,8 @@
 "use client";
 
 import { useTranslations } from "next-intl";
-import posthog from "posthog-js";
 import { useState } from "react";
+import { captureAnalyticsClick } from "../../lib/analytics";
 import { WaitlistDialog } from "./waitlist-dialog";
 
 const LOCATION = "faq";
@@ -24,7 +24,7 @@ export function FaqPlatformAnswer({ linkClass }: { linkClass: string }) {
             <button
               type="button"
               onClick={() => {
-                posthog.capture("cmuxterm_waitlist_opened", {
+                captureAnalyticsClick("cmuxterm_waitlist_opened", {
                   location: LOCATION,
                   platform: "any",
                 });
diff --git a/web/app/[locale]/components/github-button.tsx b/web/app/[locale]/components/github-button.tsx
index bbdba265b0ef..b49164bbde01 100644
--- a/web/app/[locale]/components/github-button.tsx
+++ b/web/app/[locale]/components/github-button.tsx
@@ -1,7 +1,7 @@
 "use client";
 
 import { useTranslations } from "next-intl";
-import posthog from "posthog-js";
+import { captureAnalyticsClick } from "../../lib/analytics";
 
 export function GitHubButton({ location = "hero" }: { location?: string }) {
   const t = useTranslations("common");
@@ -10,7 +10,7 @@ export function GitHubButton({ location = "hero" }: { location?: string }) {
       href="https://github.com/manaflow-ai/cmux"
       target="_blank"
       rel="noopener noreferrer"
-      onClick={() => posthog.capture("cmuxterm_github_clicked", { location })}
+      onClick={() => captureAnalyticsClick("cmuxterm_github_clicked", { location })}
       className="inline-flex items-center whitespace-nowrap gap-2 rounded-full border border-border px-5 py-2.5 text-[15px] font-medium text-foreground hover:bg-code-bg transition-colors"
     >
       <svg width="16" height="16" viewBox="0 0 24 24" fill="currentColor">
diff --git a/web/app/[locale]/components/github-stars.tsx b/web/app/[locale]/components/github-stars.tsx
index 7b44cd87683d..8317069cf6a5 100644
--- a/web/app/[locale]/components/github-stars.tsx
+++ b/web/app/[locale]/components/github-stars.tsx
@@ -1,7 +1,7 @@
 "use client";
 
 import { useEffect, useState } from "react";
-import posthog from "posthog-js";
+import { captureAnalyticsClick } from "../../lib/analytics";
 
 const STARS_CACHE_TTL_MS = 300_000;
 let cachedStars: number | null = null;
@@ -105,7 +105,7 @@ export function GitHubStarsBadge({
       target="_blank"
       rel="noopener noreferrer"
       onClick={() =>
-        posthog.capture("cmuxterm_github_clicked", { location })
+        captureAnalyticsClick("cmuxterm_github_clicked", { location })
       }
       className={classes}
     >
diff --git a/web/app/[locale]/components/nav-links.tsx b/web/app/[locale]/components/nav-links.tsx
index ac9d70ecccef..24348e77030b 100644
--- a/web/app/[locale]/components/nav-links.tsx
+++ b/web/app/[locale]/components/nav-links.tsx
@@ -2,7 +2,7 @@
 
 import { useTranslations } from "next-intl";
 import { Link } from "../../../i18n/navigation";
-import posthog from "posthog-js";
+import { captureAnalyticsClick } from "../../lib/analytics";
 import { ProUpgradeVisibility } from "./pro-upgrade-visibility";
 
 export function NavLinks() {
@@ -37,7 +37,7 @@ export function NavLinks() {
         <Link
           href="/pricing"
           onClick={() =>
-            posthog.capture("cmuxterm_pricing_nav_clicked", { location: "nav" })
+            captureAnalyticsClick("cmuxterm_pricing_nav_clicked", { location: "nav" })
           }
           className="hover:text-foreground transition-colors"
         >
@@ -48,7 +48,7 @@ export function NavLinks() {
         href="https://github.com/manaflow-ai/cmux"
         target="_blank"
         rel="noopener noreferrer"
-        onClick={() => posthog.capture("cmuxterm_github_clicked", { location: "navbar" })}
+        onClick={() => captureAnalyticsClick("cmuxterm_github_clicked", { location: "navbar" })}
         className="hover:text-foreground transition-colors"
       >
         {t("github")}
diff --git a/web/app/[locale]/components/pro-cta-link.tsx b/web/app/[locale]/components/pro-cta-link.tsx
index de2cac52199e..b96d3f7263eb 100644
--- a/web/app/[locale]/components/pro-cta-link.tsx
+++ b/web/app/[locale]/components/pro-cta-link.tsx
@@ -1,10 +1,10 @@
 "use client";
 
-import posthog from "posthog-js";
 import {
   pricingActionClassName,
   type PricingActionSize,
 } from "../../components/pricing-shared";
+import { captureAnalyticsClick } from "../../lib/analytics";
 import {
   isClientConfigFlagEnabled,
   useClientConfigFlag,
@@ -44,7 +44,7 @@ export function ProCtaLink({
     <a
       href={checkout ? checkoutHref : fallbackHref}
       onClick={() =>
-        posthog.capture("cmuxterm_pro_cta_clicked", {
+        captureAnalyticsClick("cmuxterm_pro_cta_clicked", {
           location,
           checkout,
         })
diff --git a/web/app/[locale]/components/waitlist-callout.tsx b/web/app/[locale]/components/waitlist-callout.tsx
index 6a84e653f1d5..a08425edf6d8 100644
--- a/web/app/[locale]/components/waitlist-callout.tsx
+++ b/web/app/[locale]/components/waitlist-callout.tsx
@@ -1,8 +1,8 @@
 "use client";
 
 import { useTranslations } from "next-intl";
-import posthog from "posthog-js";
 import { useState } from "react";
+import { captureAnalyticsClick } from "../../lib/analytics";
 import { WaitlistDialog } from "./waitlist-dialog";
 
 /**
@@ -27,7 +27,7 @@ export function WaitlistCallout({
         <button
           type="button"
           onClick={() => {
-            posthog.capture("cmuxterm_waitlist_opened", {
+            captureAnalyticsClick("cmuxterm_waitlist_opened", {
               location,
               platform: "any",
             });
diff --git a/web/app/[locale]/components/waitlist-dialog.tsx b/web/app/[locale]/components/waitlist-dialog.tsx
index 05172bbd9767..37f5dd833c9f 100644
--- a/web/app/[locale]/components/waitlist-dialog.tsx
+++ b/web/app/[locale]/components/waitlist-dialog.tsx
@@ -3,8 +3,8 @@
 import { Checkbox } from "@base-ui-components/react/checkbox";
 import { Dialog } from "@base-ui-components/react/dialog";
 import { useTranslations } from "next-intl";
-import posthog from "posthog-js";
 import { useRef, useState } from "react";
+import { captureAnalyticsEvent } from "../../lib/analytics";
 import {
   WAITLIST_EARLY_ACCESS_FLAGS,
   WAITLIST_PLATFORMS,
@@ -29,53 +29,34 @@ const SUBMIT_DELAY_MS = 600;
 const VALIDATE_TIMEOUT_MS = 4000;
 
 /**
- * Records a waitlist signup by POSTing the event straight to PostHog's capture
- * endpoint and awaiting delivery, so the UI shows success only when the record
- * is actually accepted (posthog-js `capture` is fire-and-forget). The event
- * `$set`s the email and Early Access enrollment, so the signup persists
- * server-side even if the SDK's own requests are blocked. Returns whether the
- * server accepted it.
+ * Records a waitlist signup through cmux's first-party analytics route and
+ * awaits delivery, so the UI shows success only when PostHog accepts the
+ * server-forwarded event. The event `$set`s the email and Early Access
+ * enrollment, so the signup persists server-side even when browser extensions
+ * block tracker-shaped PostHog ingest URLs.
  */
 async function recordWaitlistSignup(
   email: string,
   platforms: WaitlistPlatform[],
   location: string,
 ): Promise<boolean> {
-  const host = posthog.config?.api_host;
-  const token = posthog.config?.token;
-  if (!host || !token) return false;
   const enrollment = Object.fromEntries(
     platforms.map((p) => [
       `$feature_enrollment/${WAITLIST_EARLY_ACCESS_FLAGS[p]}`,
       true,
     ]),
   );
-  try {
-    // `/e/` is the capture endpoint posthog-js itself posts events to (through
-    // the same first-party `api_host` proxy), so this matches the SDK's path
-    // and payload shape rather than inventing a new one.
-    const res = await fetch(`${host.replace(/\/+$/, "")}/e/`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      keepalive: true,
-      body: JSON.stringify({
-        api_key: token,
-        event: "cmuxterm_waitlist_signup",
-        properties: {
-          distinct_id: email,
-          email,
-          platforms,
-          location,
-          $set: { email, ...enrollment },
-          $set_once: { waitlist_email: email },
-        },
-        timestamp: new Date().toISOString(),
-      }),
-    });
-    return res.ok;
-  } catch {
-    return false;
-  }
+  return await captureAnalyticsEvent(
+    "cmuxterm_waitlist_signup",
+    {
+      email,
+      platforms,
+      location,
+      $set: { email, ...enrollment },
+      $set_once: { waitlist_email: email },
+    },
+    { distinctId: email, keepalive: true },
+  );
 }
 
 /**
diff --git a/web/app/[locale]/posthog.tsx b/web/app/[locale]/posthog.tsx
index 21e81ae9edcb..1f6bdaa73126 100644
--- a/web/app/[locale]/posthog.tsx
+++ b/web/app/[locale]/posthog.tsx
@@ -4,14 +4,21 @@ import posthog from "posthog-js";
 import { PostHogProvider as PHProvider } from "posthog-js/react";
 import { usePathname, useSearchParams } from "next/navigation";
 import { useEffect, Suspense } from "react";
+import { captureAnalyticsClick } from "../lib/analytics";
 
 if (typeof window !== "undefined") {
   posthog.init("phc_opOVu7oFzR9wD3I6ZahFGOV2h3mqGpl5EHyQvmHciDP", {
-    api_host: "https://r.cmux.com",
+    api_host: "/api/analytics/posthog-sdk-disabled",
     ui_host: "https://us.posthog.com",
+    autocapture: false,
     person_profiles: "identified_only",
     capture_pageview: false,
-    capture_pageleave: true,
+    capture_pageleave: false,
+    disable_session_recording: true,
+    disable_surveys: true,
+    disable_external_dependency_loading: true,
+    advanced_disable_flags: true,
+    advanced_disable_decide: true,
     advanced_disable_feature_flags: true,
   });
 }
@@ -25,7 +32,7 @@ function PageviewTracker() {
       let url = window.origin + pathname;
       const search = searchParams.toString();
       if (search) url += "?" + search;
-      posthog.capture("$pageview", { $current_url: url });
+      captureAnalyticsClick("$pageview", { $current_url: url });
     }
   }, [pathname, searchParams]);
 
diff --git a/web/app/api/analytics/browser-events/route.ts b/web/app/api/analytics/browser-events/route.ts
new file mode 100644
index 000000000000..03284585ede8
--- /dev/null
+++ b/web/app/api/analytics/browser-events/route.ts
@@ -0,0 +1,177 @@
+import { checkRateLimit } from "@vercel/firewall";
+
+import { jsonResponse } from "../../../../services/vms/routeHelpers";
+import { readBoundedJsonObject } from "../../../../services/apns/routePolicy";
+import {
+  WAITLIST_EARLY_ACCESS_FLAGS,
+  WAITLIST_PLATFORMS,
+  type WaitlistPlatform,
+} from "../../../lib/download";
+import {
+  type BrowserAnalyticsEvent,
+  MAX_BROWSER_ANALYTICS_REQUEST_BYTES,
+  POSTHOG_HOST,
+  POSTHOG_PROJECT_KEY,
+  parseBrowserAnalyticsEvent,
+} from "../../../../services/analytics/browserEventPolicy";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const BROWSER_ANALYTICS_FORWARD_TIMEOUT_MS = 3_000;
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+export async function POST(request: Request): Promise<Response> {
+  if (process.env.VERCEL === "1") {
+    const rateLimitId = process.env.CMUX_BROWSER_ANALYTICS_RATE_LIMIT_ID?.trim();
+    if (!rateLimitId) {
+      console.error("browser-events.route.rate_limit_not_configured");
+      return jsonResponse({ error: "analytics_unavailable" }, 503);
+    }
+
+    const { error, rateLimited } = await checkRateLimit(rateLimitId, { request });
+    if (rateLimited || error === "blocked") {
+      return jsonResponse({ error: "rate_limited" }, 429);
+    }
+    if (error === "not-found") {
+      console.error("browser-events.route.rate_limit_not_found", rateLimitId);
+      return jsonResponse({ error: "analytics_unavailable" }, 503);
+    } else if (error) {
+      console.error("browser-events.route.rate_limit_error", error);
+      return jsonResponse({ error: "analytics_unavailable" }, 503);
+    }
+  }
+
+  const body = await readBoundedJsonObject(request, MAX_BROWSER_ANALYTICS_REQUEST_BYTES);
+  if (!body.ok) {
+    return jsonResponse({ error: body.error }, body.error === "request_too_large" ? 413 : 400);
+  }
+
+  const event = parseBrowserAnalyticsEvent(body.value);
+  if (!event.ok) {
+    return jsonResponse({ error: event.error }, 400);
+  }
+
+  const prepared = prepareBrowserEvent(event.value);
+  if (!prepared.ok) {
+    return jsonResponse({ error: prepared.error }, 400);
+  }
+
+  const forwarded = await forwardBrowserEvent(prepared.value);
+  if (!forwarded.ok) {
+    return jsonResponse({ error: "forward_failed" }, forwarded.status);
+  }
+  return jsonResponse({ ok: true });
+}
+
+async function forwardBrowserEvent(event: {
+  readonly event: string;
+  readonly distinctId: string;
+  readonly properties: Record<string, unknown>;
+  readonly timestamp?: string;
+}): Promise<{ readonly ok: true } | { readonly ok: false; readonly status: number }> {
+  try {
+    const response = await fetch(`${POSTHOG_HOST}/batch/`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        api_key: POSTHOG_PROJECT_KEY,
+        batch: [
+          {
+            event: event.event,
+            distinct_id: event.distinctId,
+            properties: event.properties,
+            timestamp: event.timestamp,
+          },
+        ],
+      }),
+      signal: AbortSignal.timeout(BROWSER_ANALYTICS_FORWARD_TIMEOUT_MS),
+    });
+    if (!response.ok) {
+      return { ok: false, status: response.status >= 500 ? 502 : 400 };
+    }
+    return { ok: true };
+  } catch {
+    return { ok: false, status: 502 };
+  }
+}
+
+function prepareBrowserEvent(
+  event: BrowserAnalyticsEvent,
+): { readonly ok: true; readonly value: BrowserAnalyticsEvent }
+  | { readonly ok: false; readonly error: string } {
+  if (event.event === "cmuxterm_waitlist_signup") {
+    return prepareWaitlistSignupEvent(event);
+  }
+
+  return {
+    ok: true,
+    value: {
+      ...event,
+      properties: {
+        ...event.properties,
+        $process_person_profile: false,
+      },
+    },
+  };
+}
+
+function prepareWaitlistSignupEvent(
+  event: BrowserAnalyticsEvent,
+): { readonly ok: true; readonly value: BrowserAnalyticsEvent }
+  | { readonly ok: false; readonly error: string } {
+  const email = waitlistEmail(event.properties.email);
+  if (!email || event.distinctId !== email) {
+    return { ok: false, error: "invalid_waitlist_signup" };
+  }
+
+  const platforms = waitlistPlatforms(event.properties.platforms);
+  if (!platforms) {
+    return { ok: false, error: "invalid_waitlist_signup" };
+  }
+
+  const location = waitlistLocation(event.properties.location);
+  const enrollment = Object.fromEntries(
+    platforms.map((platform) => [
+      `$feature_enrollment/${WAITLIST_EARLY_ACCESS_FLAGS[platform]}`,
+      true,
+    ]),
+  );
+
+  return {
+    ok: true,
+    value: {
+      ...event,
+      properties: {
+        email,
+        platforms,
+        ...(location ? { location } : {}),
+        $set: { email, ...enrollment },
+        $set_once: { waitlist_email: email },
+      },
+    },
+  };
+}
+
+function waitlistEmail(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const email = value.trim();
+  return email.length <= 320 && EMAIL_PATTERN.test(email) ? email : null;
+}
+
+function waitlistLocation(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const location = value.trim();
+  return location ? location.slice(0, 64) : null;
+}
+
+function waitlistPlatforms(value: unknown): WaitlistPlatform[] | null {
+  if (!Array.isArray(value)) return null;
+  const platforms = Array.from(new Set(value));
+  if (platforms.length < 1 || platforms.length > WAITLIST_PLATFORMS.length) return null;
+  return platforms.every(isWaitlistPlatform) ? platforms : null;
+}
+
+function isWaitlistPlatform(value: unknown): value is WaitlistPlatform {
+  return typeof value === "string" && WAITLIST_PLATFORMS.includes(value as WaitlistPlatform);
+}
diff --git a/web/app/env.ts b/web/app/env.ts
index 60d61b36f8c9..610ec06927f2 100644
--- a/web/app/env.ts
+++ b/web/app/env.ts
@@ -46,6 +46,7 @@ export const env = createEnv({
     CMUX_FEEDBACK_FROM_EMAIL: z.string().email(),
     CMUX_FEEDBACK_RATE_LIMIT_ID: z.string().min(1),
     CMUX_CLIENT_CONFIG_RATE_LIMIT_ID: requireVercelNonPreviewValue("CMUX_CLIENT_CONFIG_RATE_LIMIT_ID"),
+    CMUX_BROWSER_ANALYTICS_RATE_LIMIT_ID: requireVercelNonPreviewValue("CMUX_BROWSER_ANALYTICS_RATE_LIMIT_ID"),
     STACK_SECRET_SERVER_KEY: z.string().min(1),
     // APNs push (iOS notifications). Optional: the app boots without them; the
     // push route returns a clear "not configured" error until they are set.
@@ -89,6 +90,7 @@ export const env = createEnv({
     CMUX_FEEDBACK_FROM_EMAIL: trimEnv(process.env.CMUX_FEEDBACK_FROM_EMAIL),
     CMUX_FEEDBACK_RATE_LIMIT_ID: trimEnv(process.env.CMUX_FEEDBACK_RATE_LIMIT_ID),
     CMUX_CLIENT_CONFIG_RATE_LIMIT_ID: trimEnv(process.env.CMUX_CLIENT_CONFIG_RATE_LIMIT_ID),
+    CMUX_BROWSER_ANALYTICS_RATE_LIMIT_ID: trimEnv(process.env.CMUX_BROWSER_ANALYTICS_RATE_LIMIT_ID),
     CMUX_APNS_KEY_P8: trimEnv(process.env.CMUX_APNS_KEY_P8),
     CMUX_APNS_KEY_ID: trimEnv(process.env.CMUX_APNS_KEY_ID),
     CMUX_APNS_TEAM_ID: trimEnv(process.env.CMUX_APNS_TEAM_ID),
diff --git a/web/app/lib/analytics.ts b/web/app/lib/analytics.ts
new file mode 100644
index 000000000000..10c6e4d4f5c2
--- /dev/null
+++ b/web/app/lib/analytics.ts
@@ -0,0 +1,130 @@
+"use client";
+
+import posthog from "posthog-js";
+
+export type AnalyticsValue =
+  | string
+  | number
+  | boolean
+  | null
+  | readonly AnalyticsValue[]
+  | { readonly [key: string]: AnalyticsValue };
+
+export type AnalyticsProperties = Record<string, AnalyticsValue>;
+
+const FALLBACK_DISTINCT_ID_KEY = "cmux.analytics.distinct_id";
+let memoryFallbackDistinctId: string | null = null;
+
+export async function captureAnalyticsEvent(
+  event: string,
+  properties: AnalyticsProperties = {},
+  options: { readonly distinctId?: string; readonly keepalive?: boolean } = {},
+): Promise<boolean> {
+  try {
+    const response = await fetch("/api/analytics/browser-events", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      keepalive: options.keepalive ?? true,
+      body: JSON.stringify({
+        event,
+        distinctId: options.distinctId ?? getAnalyticsDistinctId(),
+        properties: {
+          ...browserProperties(),
+          ...properties,
+        },
+        timestamp: new Date().toISOString(),
+      }),
+    });
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+
+export function captureAnalyticsClick(
+  event: string,
+  properties: AnalyticsProperties = {},
+): void {
+  void captureAnalyticsEvent(event, properties, { keepalive: true });
+}
+
+export function getAnalyticsDistinctId(): string {
+  try {
+    const distinctId = posthog.get_distinct_id();
+    if (typeof distinctId === "string" && distinctId.trim()) return distinctId;
+  } catch {
+  }
+  return getFallbackDistinctId();
+}
+
+function browserProperties(): AnalyticsProperties {
+  if (typeof window === "undefined") return {};
+  return {
+    $current_url: window.location.href,
+    $host: window.location.host,
+    $pathname: window.location.pathname,
+    $lib: "cmux-web",
+  };
+}
+
+function getFallbackDistinctId(): string {
+  const storage = browserStorage();
+  const stored = readStoredDistinctId(storage);
+  if (stored) {
+    memoryFallbackDistinctId = stored;
+    return stored;
+  }
+
+  if (memoryFallbackDistinctId) {
+    writeStoredDistinctId(storage, memoryFallbackDistinctId);
+    return memoryFallbackDistinctId;
+  }
+
+  const generated = createFallbackDistinctId();
+  memoryFallbackDistinctId = generated;
+  writeStoredDistinctId(storage, generated);
+  return generated;
+}
+
+function browserStorage(): Storage | null {
+  try {
+    return typeof globalThis.localStorage === "undefined"
+      ? null
+      : globalThis.localStorage;
+  } catch {
+    return null;
+  }
+}
+
+function readStoredDistinctId(storage: Storage | null): string | null {
+  if (!storage) return null;
+  try {
+    const value = storage.getItem(FALLBACK_DISTINCT_ID_KEY)?.trim();
+    return value || null;
+  } catch {
+    return null;
+  }
+}
+
+function writeStoredDistinctId(storage: Storage | null, distinctId: string): void {
+  if (!storage) return;
+  try {
+    storage.setItem(FALLBACK_DISTINCT_ID_KEY, distinctId);
+  } catch {
+    // Storage can be disabled by privacy settings. The in-memory fallback above
+    // still keeps one id for this page lifetime.
+  }
+}
+
+function createFallbackDistinctId(): string {
+  const uuid = globalThis.crypto?.randomUUID?.();
+  if (uuid) return `cmux-web-${uuid}`;
+
+  const bytes = new Uint8Array(16);
+  globalThis.crypto?.getRandomValues?.(bytes);
+  if (bytes.some((byte) => byte !== 0)) {
+    return `cmux-web-${Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+  }
+
+  return `cmux-web-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+}
diff --git a/web/services/analytics/browserEventPolicy.ts b/web/services/analytics/browserEventPolicy.ts
new file mode 100644
index 000000000000..187f2c5983bb
--- /dev/null
+++ b/web/services/analytics/browserEventPolicy.ts
@@ -0,0 +1,129 @@
+import { POSTHOG_HOST, POSTHOG_PROJECT_KEY } from "./iosEventPolicy";
+
+export { POSTHOG_HOST, POSTHOG_PROJECT_KEY };
+
+export const MAX_BROWSER_ANALYTICS_REQUEST_BYTES = 32 * 1024;
+export const MAX_BROWSER_ANALYTICS_PROPERTIES = 64;
+export const MAX_BROWSER_ANALYTICS_ARRAY_ITEMS = 20;
+export const MAX_BROWSER_ANALYTICS_DEPTH = 3;
+export const MAX_BROWSER_ANALYTICS_STRING_CHARS = 2048;
+
+const ALLOWED_BROWSER_EVENTS: ReadonlySet<string> = new Set([
+  "$pageview",
+  "cmuxterm_download_clicked",
+  "cmuxterm_github_clicked",
+  "cmuxterm_pricing_nav_clicked",
+  "cmuxterm_pro_cta_clicked",
+  "cmuxterm_waitlist_opened",
+  "cmuxterm_waitlist_signup",
+  "compare_back_clicked",
+  "compare_link_clicked",
+  "guide_link_clicked",
+]);
+
+export type BrowserAnalyticsValue =
+  | string
+  | number
+  | boolean
+  | null
+  | readonly BrowserAnalyticsValue[]
+  | { readonly [key: string]: BrowserAnalyticsValue };
+
+export type BrowserAnalyticsEvent = {
+  readonly event: string;
+  readonly distinctId: string;
+  readonly properties: Record<string, BrowserAnalyticsValue>;
+  readonly timestamp?: string;
+};
+
+export type BrowserAnalyticsEventResult =
+  | { readonly ok: true; readonly value: BrowserAnalyticsEvent }
+  | { readonly ok: false; readonly error: string };
+
+export function parseBrowserAnalyticsEvent(
+  body: Record<string, unknown>,
+): BrowserAnalyticsEventResult {
+  if (!isAllowedBrowserAnalyticsEvent(body.event)) {
+    return { ok: false, error: "unknown_event" };
+  }
+
+  const distinctId = boundedString(body.distinctId, 512);
+  if (!distinctId) {
+    return { ok: false, error: "missing_distinct_id" };
+  }
+
+  const rawProperties =
+    body.properties && typeof body.properties === "object" && !Array.isArray(body.properties)
+      ? (body.properties as Record<string, unknown>)
+      : {};
+  const properties = sanitizeProperties(rawProperties);
+  const timestamp = boundedString(body.timestamp, 64);
+
+  return {
+    ok: true,
+    value: {
+      event: body.event,
+      distinctId,
+      properties,
+      timestamp: timestamp || undefined,
+    },
+  };
+}
+
+export function isAllowedBrowserAnalyticsEvent(name: unknown): name is string {
+  return typeof name === "string" && ALLOWED_BROWSER_EVENTS.has(name);
+}
+
+function sanitizeProperties(
+  rawProperties: Record<string, unknown>,
+): Record<string, BrowserAnalyticsValue> {
+  const properties: Record<string, BrowserAnalyticsValue> = {};
+  let count = 0;
+  for (const [key, value] of Object.entries(rawProperties)) {
+    if (count >= MAX_BROWSER_ANALYTICS_PROPERTIES) break;
+    const sanitizedKey = boundedString(key, 128);
+    if (!sanitizedKey) continue;
+    const sanitizedValue = sanitizeValue(value, 0);
+    if (sanitizedValue === undefined) continue;
+    properties[sanitizedKey] = sanitizedValue;
+    count += 1;
+  }
+  return properties;
+}
+
+function sanitizeValue(
+  value: unknown,
+  depth: number,
+): BrowserAnalyticsValue | undefined {
+  if (value === null) return null;
+  if (typeof value === "boolean") return value;
+  if (typeof value === "number") return Number.isFinite(value) ? value : undefined;
+  if (typeof value === "string") return value.slice(0, MAX_BROWSER_ANALYTICS_STRING_CHARS);
+  if (depth >= MAX_BROWSER_ANALYTICS_DEPTH) return undefined;
+  if (Array.isArray(value)) {
+    const items: BrowserAnalyticsValue[] = [];
+    for (const item of value.slice(0, MAX_BROWSER_ANALYTICS_ARRAY_ITEMS)) {
+      const sanitized = sanitizeValue(item, depth + 1);
+      if (sanitized !== undefined) items.push(sanitized);
+    }
+    return items;
+  }
+  if (typeof value === "object") {
+    const result: Record<string, BrowserAnalyticsValue> = {};
+    for (const [key, nested] of Object.entries(value as Record<string, unknown>)) {
+      const sanitizedKey = boundedString(key, 128);
+      if (!sanitizedKey) continue;
+      const sanitized = sanitizeValue(nested, depth + 1);
+      if (sanitized !== undefined) result[sanitizedKey] = sanitized;
+    }
+    return result;
+  }
+  return undefined;
+}
+
+function boundedString(value: unknown, maxChars: number): string | null {
+  if (typeof value !== "string") return null;
+  const text = value.trim();
+  if (!text || text.length > maxChars) return null;
+  return text;
+}
diff --git a/web/tests/analytics-client.test.ts b/web/tests/analytics-client.test.ts
new file mode 100644
index 000000000000..33d2581bcef9
--- /dev/null
+++ b/web/tests/analytics-client.test.ts
@@ -0,0 +1,100 @@
+import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+
+let currentPostHogDistinctId: () => string = () => "posthog-distinct-id";
+const postHogDistinctId = mock(() => currentPostHogDistinctId());
+
+mock.module("posthog-js", () => ({
+  default: {
+    get_distinct_id: postHogDistinctId,
+  },
+}));
+
+const originalLocalStorageDescriptor = Object.getOwnPropertyDescriptor(globalThis, "localStorage");
+const { getAnalyticsDistinctId } = await import("../app/lib/analytics");
+
+afterAll(() => {
+  if (originalLocalStorageDescriptor) {
+    Object.defineProperty(globalThis, "localStorage", originalLocalStorageDescriptor);
+  } else {
+    delete (globalThis as { localStorage?: Storage }).localStorage;
+  }
+});
+
+beforeEach(() => {
+  postHogDistinctId.mockClear();
+  currentPostHogDistinctId = () => "posthog-distinct-id";
+  setLocalStorage(new MemoryStorage());
+});
+
+describe("analytics client distinct id", () => {
+  test("uses the PostHog distinct id when it is available", () => {
+    expect(getAnalyticsDistinctId()).toBe("posthog-distinct-id");
+  });
+
+  test("persists a generated fallback id when PostHog returns a blank id", () => {
+    currentPostHogDistinctId = () => " ";
+
+    const first = getAnalyticsDistinctId();
+    const second = getAnalyticsDistinctId();
+
+    expect(first).toStartWith("cmux-web-");
+    expect(second).toBe(first);
+    expect(globalThis.localStorage.getItem("cmux.analytics.distinct_id")).toBe(first);
+  });
+
+  test("uses an existing browser fallback id when PostHog throws", () => {
+    globalThis.localStorage.setItem("cmux.analytics.distinct_id", "cmux-web-existing-browser-id");
+    currentPostHogDistinctId = () => {
+      throw new Error("posthog unavailable");
+    };
+
+    expect(getAnalyticsDistinctId()).toBe("cmux-web-existing-browser-id");
+  });
+
+  test("keeps a page-lifetime fallback id when browser storage is unavailable", () => {
+    currentPostHogDistinctId = () => "";
+    setLocalStorage(undefined);
+
+    const first = getAnalyticsDistinctId();
+    const second = getAnalyticsDistinctId();
+
+    expect(first).not.toBe("anonymous");
+    expect(first).toStartWith("cmux-web-");
+    expect(second).toBe(first);
+  });
+});
+
+function setLocalStorage(storage: Storage | undefined): void {
+  Object.defineProperty(globalThis, "localStorage", {
+    configurable: true,
+    value: storage,
+  });
+}
+
+class MemoryStorage implements Storage {
+  private readonly values = new Map<string, string>();
+
+  get length(): number {
+    return this.values.size;
+  }
+
+  clear(): void {
+    this.values.clear();
+  }
+
+  getItem(key: string): string | null {
+    return this.values.get(key) ?? null;
+  }
+
+  key(index: number): string | null {
+    return Array.from(this.values.keys())[index] ?? null;
+  }
+
+  removeItem(key: string): void {
+    this.values.delete(key);
+  }
+
+  setItem(key: string, value: string): void {
+    this.values.set(key, value);
+  }
+}
diff --git a/web/tests/browser-analytics-route.test.ts b/web/tests/browser-analytics-route.test.ts
new file mode 100644
index 000000000000..a1635b9d655d
--- /dev/null
+++ b/web/tests/browser-analytics-route.test.ts
@@ -0,0 +1,177 @@
+import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+
+const originalFetch = globalThis.fetch;
+const originalVercel = process.env.VERCEL;
+const originalBrowserAnalyticsRateLimitId = process.env.CMUX_BROWSER_ANALYTICS_RATE_LIMIT_ID;
+
+const fetchMock = mock(async () => new Response("ok", { status: 200 }));
+const checkRateLimit = mock(async () => ({ rateLimited: false, error: null }));
+
+mock.module("@vercel/firewall", () => ({
+  checkRateLimit,
+}));
+
+globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+const { POST } = await import("../app/api/analytics/browser-events/route");
+const { POSTHOG_PROJECT_KEY } = await import("../services/analytics/browserEventPolicy");
+
+afterAll(() => {
+  globalThis.fetch = originalFetch;
+  restoreEnv("VERCEL", originalVercel);
+  restoreEnv("CMUX_BROWSER_ANALYTICS_RATE_LIMIT_ID", originalBrowserAnalyticsRateLimitId);
+});
+
+beforeEach(() => {
+  process.env.VERCEL = "0";
+  process.env.CMUX_BROWSER_ANALYTICS_RATE_LIMIT_ID = "cmux-browser-analytics-test";
+  fetchMock.mockClear();
+  fetchMock.mockResolvedValue(new Response("ok", { status: 200 }));
+  checkRateLimit.mockClear();
+  checkRateLimit.mockResolvedValue({ rateLimited: false, error: null });
+});
+
+function request(body: unknown): Request {
+  return new Request("https://cmux.test/api/analytics/browser-events", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+function rawRequest(body: string): Request {
+  return new Request("https://cmux.test/api/analytics/browser-events", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body,
+  });
+}
+
+function restoreEnv(key: string, value: string | undefined): void {
+  if (value === undefined) {
+    delete process.env[key];
+  } else {
+    process.env[key] = value;
+  }
+}
+
+describe("browser analytics route", () => {
+  test("forwards allowlisted browser events to PostHog from the server", async () => {
+    const response = await POST(request({
+      event: "cmuxterm_download_clicked",
+      distinctId: "visitor-1",
+      properties: {
+        location: "hero",
+        platform: "mac",
+        nested: { kept: true },
+        $process_person_profile: true,
+      },
+      timestamp: "2026-07-07T12:00:00.000Z",
+    }));
+
+    expect(response.status).toBe(200);
+    expect(await response.json()).toEqual({ ok: true });
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    const calls = (fetchMock as unknown as {
+      mock: { calls: Array<[string | URL | Request, RequestInit?]> };
+    }).mock.calls;
+    expect(calls[0]?.[0]).toBe("https://r.cmux.com/batch/");
+    const body = JSON.parse((calls[0]?.[1]?.body as string) ?? "{}");
+    expect(body).toMatchObject({
+      api_key: POSTHOG_PROJECT_KEY,
+      batch: [
+        {
+          event: "cmuxterm_download_clicked",
+          distinct_id: "visitor-1",
+          properties: {
+            location: "hero",
+            platform: "mac",
+            nested: { kept: true },
+            $process_person_profile: false,
+          },
+          timestamp: "2026-07-07T12:00:00.000Z",
+        },
+      ],
+    });
+  });
+
+  test("preserves waitlist enrollment properties", async () => {
+    const response = await POST(request({
+      event: "cmuxterm_waitlist_signup",
+      distinctId: "ada@example.com",
+      properties: {
+        email: "ada@example.com",
+        platforms: ["linux", "windows"],
+        location: "download-menu",
+        $set: {
+          email: "mallory@example.com",
+          "$feature_enrollment/anything-goes": true,
+        },
+        $set_once: { waitlist_email: "mallory@example.com" },
+      },
+    }));
+
+    expect(response.status).toBe(200);
+    const calls = (fetchMock as unknown as {
+      mock: { calls: Array<[string | URL | Request, RequestInit?]> };
+    }).mock.calls;
+    const body = JSON.parse((calls[0]?.[1]?.body as string) ?? "{}");
+    expect(body.batch[0].properties).toEqual({
+      email: "ada@example.com",
+      location: "download-menu",
+      platforms: ["linux", "windows"],
+      $set: {
+        email: "ada@example.com",
+        "$feature_enrollment/cmux-for-linux": true,
+        "$feature_enrollment/cmux-for-windows": true,
+      },
+      $set_once: { waitlist_email: "ada@example.com" },
+    });
+    expect(body.batch[0].properties).not.toHaveProperty("$process_person_profile");
+  });
+
+  test("rejects invalid waitlist signup mutations before forwarding", async () => {
+    const response = await POST(request({
+      event: "cmuxterm_waitlist_signup",
+      distinctId: "ada@example.com",
+      properties: {
+        email: "ada@example.com",
+        platforms: ["linux", "anything-goes"],
+      },
+    }));
+
+    expect(response.status).toBe(400);
+    expect(await response.json()).toEqual({ error: "invalid_waitlist_signup" });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  test("rejects arbitrary event names before forwarding", async () => {
+    const response = await POST(request({
+      event: "anything_goes",
+      distinctId: "visitor-1",
+      properties: { location: "hero" },
+    }));
+
+    expect(response.status).toBe(400);
+    expect(await response.json()).toEqual({ error: "unknown_event" });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  test("rate-limits Vercel requests before parsing or forwarding", async () => {
+    process.env.VERCEL = "1";
+    process.env.CMUX_BROWSER_ANALYTICS_RATE_LIMIT_ID = " cmux-browser-analytics-test\n";
+    checkRateLimit.mockResolvedValue({ rateLimited: true, error: null });
+
+    const response = await POST(rawRequest("{"));
+
+    expect(response.status).toBe(429);
+    expect(await response.json()).toEqual({ error: "rate_limited" });
+    expect(checkRateLimit).toHaveBeenCalledTimes(1);
+    const calls = (checkRateLimit as unknown as {
+      mock: { calls: Array<[string, { request: Request }]> };
+    }).mock.calls;
+    expect(calls[0]?.[0]).toBe("cmux-browser-analytics-test");
+    expect(calls[0]?.[1]?.request.url).toBe("https://cmux.test/api/analytics/browser-events");
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});
diff --git a/web/tests/client-config-env.test.ts b/web/tests/client-config-env.test.ts
index eabd98c1727e..258a709f338b 100644
--- a/web/tests/client-config-env.test.ts
+++ b/web/tests/client-config-env.test.ts
@@ -22,9 +22,10 @@ describe("client config env validation", () => {
 
     expect(result.exitCode).toBe(0);
     expect(result.stderr).not.toContain("CMUX_CLIENT_CONFIG_RATE_LIMIT_ID is required");
+    expect(result.stderr).not.toContain("CMUX_BROWSER_ANALYTICS_RATE_LIMIT_ID is required");
   });
 
-  test("requires the limiter id in explicit Vercel production deployments", () => {
+  test("requires limiter ids in explicit Vercel production deployments", () => {
     const result = importEnv({
       ...requiredEnv,
       VERCEL: "1",
@@ -33,14 +34,16 @@ describe("client config env validation", () => {
 
     expect(result.exitCode).not.toBe(0);
     expect(result.stderr).toContain("CMUX_CLIENT_CONFIG_RATE_LIMIT_ID is required");
+    expect(result.stderr).toContain("CMUX_BROWSER_ANALYTICS_RATE_LIMIT_ID is required");
   });
 
-  test("accepts explicit Vercel production deployments with the limiter id", () => {
+  test("accepts explicit Vercel production deployments with limiter ids", () => {
     const result = importEnv({
       ...requiredEnv,
       VERCEL: "1",
       VERCEL_ENV: "production",
       CMUX_CLIENT_CONFIG_RATE_LIMIT_ID: "client-config-rule",
+      CMUX_BROWSER_ANALYTICS_RATE_LIMIT_ID: "browser-analytics-rule",
     });
 
     expect(result.exitCode).toBe(0);