Analytics · License MIT

Tacilytics

Privacy-first, cookieless analytics for websites and apps. One small script, one Node process, one SQLite file. No cookies, no stored IPs, no tracking across sites. We count every page view on getmind.io and seven other sites of ours with it.

npx tacilytics serve

GitHubnpmWebsiteLive demoUse it hosted

  • No cookies, nothing written to the visitor’s device
  • IPs are never stored, visitors are counted with a daily salted one-way hash
  • ~5 KB tracker (gzipped, measured 18.10.2026)
  • Node + SQLite, no Postgres, ClickHouse or Redis

What Tacilytics shows you

The dashboard answers the questions most site owners actually have: how many people came, which pages they read, where they came from and whether they did what you hoped.

  • Unique visitors, page views, bounce rate, visit time and live visitors
  • Pages with top, entry and exit views, sources, UTM campaigns, countries, browsers, OS and devices
  • Goals and custom events with properties and conversion rates
  • Revenue by source for shops, site search, scroll depth and visitor journeys
  • Click any row to filter the whole dashboard to that segment, filters stack
Tacilytics dashboard of the public demo shop with visitors, page views, revenue and conversion rate

How it counts without cookies

The tracker sends a small beacon with the path, the referrer, the time zone and the language. The server parses the user agent, drops bots, maps the time zone to a country and builds a daily visitor hash from IP and user agent with a random salt. Only the hash is stored.

The salt lives in its own file, never in the database, and is overwritten when the next day starts. After that, past days cannot be linked again, not even with the database, a known IP or the server’s own secrets.

Privacy controls

Whether you still need consent depends on your country and the rest of your site. This is not legal advice. We explain the background in our article Cookieless analytics.

  • Strict mode (data-strict) stops reading anything on the device beyond what every request carries: no localStorage, time zone, language or window size
  • Server mode: no script on the visitor’s device at all, your server reports page views over the API
  • DNT and Global Privacy Control are honoured with data-honor-dnt
  • Auto-purge of raw events after a retention window you choose

Get started

Set WEB_PASSWORD, SESSION_SECRET, INGEST_SALT and API_KEY in a .env file, put a reverse proxy with TLS in front, add your site and paste one script tag into your <head>. Docker and a source install work too.

mkdir my-analytics && cd my-analytics
npx tacilytics serve      # http://127.0.0.1:3920

For agents and developers

  • A REST API at /api/v1 with the same segmentation as the dashboard
  • A CLI with --json, for example tacilytics stats example.com 30d --country=DE
  • A Flutter SDK for mobile apps and a WordPress plugin
  • Import from Google Analytics 4 and Plausible so you do not start at zero
Lower half of the Tacilytics dashboard with pages, sources, countries, browsers, devices and goals

Honest limits

  • No returning visitors across days: monthly uniques are the sum of daily uniques
  • No cross-device journeys and only same-day attribution
  • Country comes from the time zone, not the IP, so there are no city reports
  • Built on SQLite: great for shops, blogs and company sites, not yet for millions of hits per day

Hosted or self-hosted

Tacilytics is free and MIT-licensed. If you would rather not run a server, Tacilytics Cloud is the same software run by us on servers in Germany, with a data processing agreement.

More open-source projects

NyxMixNyxVaultNyxCompress