Fathom Analytics

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me analytics that replace Fathom: visitors, pages, referrers and goals on one screen, with no cookie and nothing that needs a consent banner.

STACK
- Node 20+ with Fastify
- SQLite through better-sqlite3, WAL mode
- A tracking script under 2KB gzipped, served from my own domain
- Server-rendered dashboard, charts as inline SVG drawn by hand
- Caddy in front

THE DATA MODEL
- sites: id, domain, name, timezone, salt, is_public, created_at
- pageviews: id, site_id, path, query, referrer_host, referrer_url, utm_json, country, lang, device, browser, os, screen_bucket, status, duration_ms, bot, prefetch, visitor_hash, session_id, is_entry, is_exit, created_at
- goals: id, site_id, name, kind, config_json — a path, a custom event, or an outbound link
- conversions: id, goal_id, pageview_id, value_cents, created_at
- events: id, site_id, name, path, value_num, meta_json, visitor_hash, bot, created_at
- Record more than you publish. A signal not captured today starts from zero the day somebody wants it, and a missing year cannot be bought back

NO COOKIE, WHICH IS THE ENTIRE POSITION
- Nothing is written to the visitor's browser. No cookie, no localStorage, no fingerprint
- visitor_hash is HMAC-SHA256 of the address, the user agent and a per-site salt that rotates daily. The address and the raw user agent are discarded immediately and never stored
- The daily rotation means a visitor cannot be followed from one day to the next. That is the honest trade, and it means 'visitors today' is exact while 'visitors this month' is an estimate — say so on the page, next to the number
- This is the same construction the reputable privacy-first analytics products use, and it is stricter than any cookie: nothing is stored on the device, and the hash identifies nobody
- Write a page in your own words explaining exactly what is collected and what is never done with it, and link it from the dashboard. If you cannot explain your own collection in six sentences, collect less

WHY THIS AVOIDS A BANNER — AND THE HONEST CAVEAT
- No storage on the device is what takes it outside the cookie rules
- Whether the processing needs a legal basis is a separate question and depends on where you and your visitors are. The README states the design and says plainly that this is not legal advice
- Nothing is sent to any third party, ever. That is the property that makes the rest defensible

WHAT IT MEASURES
- Views, visitors, sessions, bounce rate, average time on page, pages per session — each with its definition written beside it, because everybody computes these differently
- Top pages, top referrers with the full URL kept so 'which thread on which forum' is answerable, countries, devices, browsers, operating systems, languages
- Entry and exit pages
- UTM parameters parsed into their own columns, and referrers grouped into sources — search, social, direct, referral — with the grouping rules visible and editable rather than magic
- Goals with a conversion rate and an optional value
- Any figure filterable by any dimension, always, with a comparison against the previous period

BOTS AND PREFETCHES, WHICH DECIDE WHETHER THE NUMBERS MEAN ANYTHING
- Flag, never drop. A bot row is written with bot = 1 and excluded through a SQL view, so the filtering lives in one place rather than in fifteen chances to forget it
- Detection from the user agent list, from whether the script executed at all, and from behaviour — no referrer, one page, zero time, arrivals too regular to be human
- Prefetches and prerenders identified from the request headers and kept out of the view count. Two refreshes must not produce six views, which is what happens the first time a site turns on link prefetching
- Redirects do not count, and only a GET can be a page view. A HEAD from an uptime monitor is answered, not read

THE DASHBOARD
- One screen. Four headline numbers, a chart, and the tables underneath. Resist adding a second page — the product being replaced is bought precisely because it fits on one screen
- Dark and light, fast, no framework
- A public sharing link per site, read-only, optionally password-protected

COLLECTION
- The endpoint answers 204 in a couple of milliseconds and writes after responding
- Country from a local database file. Never an external geolocation API
- A fallback for browsers with the script blocked: an image beacon, or server-side logging from the reverse proxy

OPERATIONS
- .env: DATABASE_PATH, BASE_URL, HASH_SALT, GEOIP_DB_PATH, SESSION_SECRET
- Migrations on boot, each once
- Nightly backup off the machine, restore script
- Health endpoint

WHAT MATTERS MOST
The bot flag and the written definitions. Build collection, flagging and the excluding view before the dashboard, then compare a week of your own numbers against the server's access log and account for the difference. Analytics whose numbers you cannot defend in a sentence are worse than none — and the moment anyone else is shown them, a number you cannot explain is a number that will be doubted.

Give me the repository, the tracking script, migrations, .env.example, and a README with deploy steps behind Caddy and the privacy page written out.