Shield

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me the analytics I actually need instead of Shield — and read the first paragraph, because it decides everything.

**The data is not exposed.** Shield works by having a relationship with the platform, or by reading what the platform shows a signed-in user. Neither is available to you: scraping a social platform breaks its terms, gets accounts restricted, and breaks the week they change their markup. So the honest build is the half that is yours — your own posting record, your own link clicks, and whatever the platform's official API does give you. That is genuinely useful, and it is less than the product.

STACK
- Node 20+ with Fastify, server-rendered HTML
- SQLite through better-sqlite3, WAL mode
- The platform's official API, whatever it offers
- Caddy in front

WHAT YOU CAN HAVE, HONESTLY
- **Everything you posted**: content, time, format, length, whether it had a link, an image or a video, and any tags. That is your own record and nobody can take it away
- **Whatever metrics the official API returns** for your own posts — usually impressions, reactions and comments, sometimes only some of those, sometimes with a delay
- **Link clicks**, in full, if every link goes through your own short domain. This is the one metric that is entirely yours and often the most meaningful
- **Follower count over time**, sampled from the API
- What you cannot have: per-viewer detail, demographics the platform does not expose, and other people's posts. Say so in the interface rather than presenting an estimate as a fact

THE DATA MODEL
- accounts: id, platform, handle, credentials_encrypted, token_expires_at, is_active
- posts: id, account_id, external_id, published_at, body, format, has_link, has_image, has_video, word_count, tags_json, campaign
- metric_snapshots: id, post_id, kind, value, collected_at — append-only, one row per collection. Never overwritten, because a post's numbers move for days and the curve is the interesting part
- follower_snapshots: id, account_id, count, at
- links: id, post_id, url, token; clicks: id, link_id, at, referrer_host, country, device, ip_hash, bot
- Every figure computed at query time from snapshots, so a total can never disagree with the rows under it

COLLECTING
- Poll the API on a schedule after publishing — an hour, six hours, a day, three days, a week — because engagement accrues over days and a single reading is meaningless
- Respect rate limits with backoff, and record every collection attempt whether or not it succeeded
- A metric the API stops returning is recorded as absent, never as zero. That distinction matters when you look back in a year
- Tokens refreshed under a lock, and a connection that fails to refresh alerts rather than silently stopping

WHAT TO ACTUALLY MEASURE
- Engagement rate with its denominator stated — impressions if you have them, followers if you do not, and never mixed between posts
- Performance by format, by length, by time of day and day of week, over enough posts to mean something. Show the sample size next to every comparison, because forty posts is not a finding
- The distribution rather than the average: social performance is heavily skewed, and a mean is dominated by one post
- Click-through from your own short domain, which is the number that survives every platform change
- Growth over time, and posts ranked by clicks rather than by reactions — reactions are cheap and clicks are intent

THE HONEST FRAMING
- Put the sample size and the definition next to every number, and mark clearly which come from the platform and which are yours
- Best-time-to-post from your own history is a weak signal from a small sample. Label it as such rather than presenting it as a science
- No estimated reach, no invented demographics, no scraped competitor data

OPERATIONS
- .env: DATABASE_PATH, BASE_URL, ENCRYPTION_KEY, HASH_SALT, SESSION_SECRET, platform credentials
- Migrations on boot, each once; nightly backup off the machine
- Health endpoint reporting token expiry and the age of the last successful collection

WHAT MATTERS MOST
Your own short domain and snapshots over time. Those two are entirely under your control, they survive any platform decision, and together they answer the only question that matters: which posts actually sent somebody somewhere.