Context

Requests to shortleash.dev pass through Cloudflare, and Web Analytics was on for its zone, so Cloudflare added its beacon to every page. The site's Content-Security-Policy blocked the script, so nothing was counted, while the privacy policy promised no analytics on the website. With the site growing to a dozen feature pages, knowing which ones people read, and how fast they load for them, helps decide what to improve.

Decision

Keep Cloudflare Web Analytics on the website, through Cloudflare's automatic setup for the zone. It counts page views and visits and measures load times and Core Web Vitals. Cloudflare describes it as not using cookies or local storage to track visitors and not fingerprinting them.
Let its script run: the CSP's script-src gains https://static.cloudflareinsights.com. On a proxied site the beacon reports to the site's own /cdn-cgi/rum, which connect-src 'self' already allows.
Say so. The privacy policy's website section names Web Analytics and what it records, and its promise about collecting data is about the app.
Nothing else. No other analytics, no third-party scripts, no cookies set by the site.
The app is unchanged: Short Leash itself has no analytics or tracking.

Consequences

Visits and page speed can be seen in Cloudflare's dashboard, per page.
Deploy previews aren't proxied by Cloudflare, so the beacon only runs on shortleash.dev; it's checked there after a deploy.
Visitors who block Cloudflare's script, or turn off JavaScript, aren't counted; that's fine.