diff --git a/CHANGELOG.md b/CHANGELOG.md
index 675364f..8b3651f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,7 @@
 
 ## May 2026
 
+- Add Cloudflare Web Analytics: privacy-preserving, cookieless beacon injected into `BaseLayout.astro` so per-page traffic, referrers, and Core Web Vitals show up in the Cloudflare dashboard scoped to `unique.rzen.dev`. Privacy statement on `/legal/` updated to disclose the beacon
 - Colocate every collection's articles with their media: each entry is now a folder `<slug>/index.mdx` with sibling media files. Applied to `reviews/`, `find/` (104 articles + 89 heroes auto-resolved by `src/lib/find-hero.ts` via `import.meta.glob('../content/find/*/hero.{...}')`), `finds/`, and `posts/`. Slug derivation handled by a shared `stripIndex` helper on each glob loader; URLs unchanged across the entire site. MDX paths shortened from `../../assets/reviews/<slug>/<file>` to `./<file>`. `src/assets/` removed entirely
 - Media optimization pass: re-encode the 13 heaviest assets (h264 CRF 28, scale ≤1280px, audio stripped) and convert the two animated GIFs (cotypist, flux-markdown) to MP4 — `dist/` drops from 53 MB to 31 MB (~42% smaller); biggest single wins are `homerow/search.mp4` (6.7 MB → 1.6 MB), `antinote/links.mp4` (2.9 MB → 193 KB), `flux-markdown/demo.gif` (3.9 MB → 1.3 MB MP4). Originals preserved at `src/assets/reviews/<slug>/source/` and never bundled
 - Tile videos on `/` and `/grid/` switched from `preload="metadata"` to `preload="none"` so below-the-fold demos don't fetch on page load
diff --git a/README.md b/README.md
index 0826096..3abc955 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,8 @@ Built with [Astro](https://astro.build) + MDX.
 - **SEO surface**: single `<SEO>` component owning canonical, Open Graph, Twitter Card, and JSON-LD; per-page structured data (`Review`, `BlogPosting`, `Product`, `Article`, `CollectionPage`, `ItemList`, `BreadcrumbList`, `WebSite`, `Organization`); auto-generated `sitemap-index.xml` (excludes `/grid/` and `/index3/`); RSS feed at `/rss.xml`; `robots.txt`; static OG image fallbacks under `/public/og/`; promoted finds canonical to their review
 - Custom 404 page with recent-reviews and navigation fallback
 - Light/dark mode via `prefers-color-scheme`
-- No JavaScript shipped to the client
+- **Cloudflare Web Analytics** beacon in `BaseLayout.astro` for cookieless, privacy-preserving page-view + referrer + Core Web Vitals tracking scoped to `unique.rzen.dev`
+- Otherwise no client-side framework — only the inline theme bootstrap and the analytics beacon
 - Static build, deployable anywhere
 
 ## Local development
diff --git a/src/layouts/BaseLayout.astro b/src/layouts/BaseLayout.astro
index 776b176..6c8886d 100644
--- a/src/layouts/BaseLayout.astro
+++ b/src/layouts/BaseLayout.astro
@@ -75,6 +75,7 @@ const year = new Date().getFullYear();
       articleTags={articleTags}
       jsonLd={jsonLd}
     />
+    <script defer src="https://static.cloudflareinsights.com/beacon.min.js" data-cf-beacon='{"token": "fc978456945c49ae90a0b7e0b891ffd2"}'></script>
     <script is:inline>
       (function () {
         try {
diff --git a/src/pages/legal.astro b/src/pages/legal.astro
index 9f6d2fd..ba8b86b 100644
--- a/src/pages/legal.astro
+++ b/src/pages/legal.astro
@@ -19,11 +19,15 @@ const breadcrumbs = buildBreadcrumbs([
   <article>
     <h2>Privacy</h2>
     <p>
-      Unique doesn't run analytics, ad pixels, or third-party trackers. The
-      site sets no cookies of its own. Your visit produces a normal web-server
-      access log entry (IP, user-agent, referrer, requested path) at our
-      hosting provider, kept only for the rolling window needed to investigate
-      abuse and outages, and never sold or shared.
+      Unique uses Cloudflare Web Analytics — a privacy-preserving, cookieless
+      beacon that records aggregate page views, referrers, and country (derived
+      from IP at request time and discarded). It sets no cookies and does not
+      fingerprint or identify visitors. The site itself sets no cookies, and
+      runs no ad pixels or third-party trackers beyond that beacon. Your visit
+      also produces a normal web-server access log entry (IP, user-agent,
+      referrer, requested path) at our hosting provider, kept only for the
+      rolling window needed to investigate abuse and outages, and never sold
+      or shared.
     </p>
     <p>
       Outbound links go to third-party sites that have their own privacy