A privacy-focused, zero-cookie, open-source analytics platform designed for lightweight self-hosting. Track page views, referrers, devices, and custom events on your websites without cookie banners or long-lived user profiles.
Unlike traditional analytics tools that build long-term user profiles and require intrusive cookie consent banners, Privacy Tracker keeps collection intentionally narrow:
- No Cookies / LocalStorage: The client-side script does not read, write, or require local browser cookies or storage.
- Anonymized Sessions: The server discards the raw IP address immediately. It generates a daily-rotating session hash using:
SHA256(IP + UserAgent + WebsiteID + DailyDateSalt)This allows daily unique-visitor counts without building persistent cross-day identity profiles. - Vanilla JS Tracker: The tracking script is tiny, dependency-free, and non-blocking.
For disclosure language and implementation notes, see Privacy Policy Guidance. For the project audit and future milestones, see Development Roadmap.
- Multi-Site Dashboard: Track multiple domain configurations under a single dashboard.
- Real-Time Telemetry: View page views, top pages, referrers, browser breakdowns, and custom events.
- Easy Self-Hosting: Built with Next.js, Prisma, and SQLite for lightweight VPS deployments.
- Container Ready: Run with Docker Compose using a persistent SQLite volume.
- SQLite First: The default schema uses SQLite. PostgreSQL is possible later, but requires a Prisma provider/schema migration rather than only changing an environment variable.
- Passwordless Admin Access: Log in with passkeys through WebAuthn/FIDO2. First admin registration is protected by a one-time setup token.
git clone https://github.com/pinksnafu/trackmeprivately.git
cd trackmeprivately
npm ciCreate a .env file in the root of the project:
DATABASE_URL="file:./dev.db"
NEXTAUTH_SECRET="replace-with-a-strong-random-secret"
# WebAuthn Host/Origin Constraints
ALLOWED_RP_ID="localhost"
ALLOWED_RP_ORIGIN="http://localhost:3000"For production, set ALLOWED_RP_ID to the analytics host, such as
analytics.example.com, and ALLOWED_RP_ORIGIN to the exact HTTPS origin.
Sync the database schema:
npx prisma db pushnpm run build
npm startFor local development, use:
npm run devDocker users can follow the Docker Deployment Guide.
On first boot with an empty database, the app logs a setup token and writes it to
prisma/setup_token.txt. Visit /login, enter the token, and register a
passkey. The setup token is deleted after the first user is created.
Embed this code in the <head> or before </body> of the websites you want to track:
<script
src="https://your-analytics-domain.com/tracker.js"
data-endpoint="https://your-analytics-domain.com/api/collect"
data-website-id="YOUR_WEBSITE_ID"
async
></script>This repository includes an AGENTS.md file in the root directory. It contains directory structure, database schema notes, authentication flow details, and coding standards for human developers and AI coding agents.
This project is open-source and available under the MIT License.