diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 85baf56..73a4824 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -53,6 +53,10 @@ jobs:
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
       - name: Build the web app
         working-directory: apps/fieldcraft-web
+        env:
+          # Usage analytics only in the deployed build (main), and only with the user's consent
+          # (docs/privacy.md); develop builds get an empty key, which sends nothing.
+          FIELDCRAFT_POSTHOG_KEY: ${{ github.ref == 'refs/heads/main' && secrets.POSTHOG_KEY || '' }}
         run: trunk build --release --public-url /fieldcraft/
       - name: Bundle size
         run: |
diff --git a/docs/privacy.md b/docs/privacy.md
index cdfa44b..4390258 100644
--- a/docs/privacy.md
+++ b/docs/privacy.md
@@ -80,5 +80,5 @@ A `command_run` as sent:
 The events and the policy are `fieldcraft_engine::usage`; the consent question and the settings
 are `crates/ui-egui/src/privacy.rs`; the desktop sender is `apps/fieldcraft/src/usage.rs`, the
 web one `apps/fieldcraft-web/src/usage.rs`. The PostHog project key is the build-time variable
-`FIELDCRAFT_POSTHOG_KEY`, which the release workflow sets from the repository secret
+`FIELDCRAFT_POSTHOG_KEY`, which the release workflow and the Pages build of `main` set from the repository secret
 `POSTHOG_KEY`; it is an ingest-only key. A new event or property is added here first.