What is Analytics Platform?

Analytics Platform is a privacy-friendly web analytics tool that helps you understand your website traffic without compromising user privacy. It provides real-time insights, page views, referrers, and more — all without cookies.

How does Analytics Platform work?

Add one line of HTML to your website. The script this deployment serves is 6,642 bytes, 2,539 gzipped. It collects page view data, referrer information and device statistics, it writes no cookie, and it posts only to this origin — never to Google.

Is Analytics Platform a Google Analytics alternative?

Yes! Analytics Platform is designed as a privacy-first alternative to Google Analytics. It provides essential metrics like page views, unique visitors, referrers, and geography — without the complexity or privacy concerns of GA.

Is Analytics Platform free?

Analytics Platform offers a generous free tier for small websites. You can track your sites without any cost. Premium plans are available for higher traffic volumes and advanced features.

What does Analytics Platform store about a visitor?

The mechanism, in full: the tracker writes no cookie and sends nothing to Google. A visitor IP is read on the request to resolve an approximate location and is never written to the pageview record — there is no IP column. The tracker does write one first-party localStorage id, created once and never rotated, which is what makes a second visit the same visitor; being first-party, it is not readable on any other site. We describe that mechanism and stop there rather than drawing a legal conclusion from it.

Webhooks

HTTP callbacks for pageview, goal and alert events. Webhooks are per-user. Signing secrets are shown in full exactly once.

5 endpoints, all relative to https://analytics.appfor.you. Shared rules live in Conventions, Rate limits and Error codes.

List webhooks

GET/api/v2/sites/{siteId}/webhooksscope: read

Signing secrets are MASKED as `****<last 4>` so a leaked listing cannot be used to forge signatures.

Path parameters

siteId

string

The Mongo _id returned as `siteId` by GET /api/v2/sites, or the public `trackingId` embedded in the tracking snippet. Both are accepted everywhere.

Query parameters

Name	Type	Description
enabled	boolean	Filter to only enabled (`true`) or only disabled (`false`) records. Omit for all.
limit	integer	Rows to return. Default 50, minimum 1, maximum 500.
offset	integer	Rows to skip, for paging. Default 0.

Example request

curl -H "Authorization: Bearer $ANALYTICS_API_KEY" \
  "https://analytics.appfor.you/api/v2/sites/6507f1f77bcf86cd799439011/webhooks"

Example response

{
  "webhooks": [
    {
      "webhookId": "6512ee05bcf86cd7994390e5",
      "siteId": "6507f1f77bcf86cd799439011",
      "url": "https://hooks.example.com/analytics",
      "events": ["goal_completed", "alert_triggered"],
      "enabled": true,
      "secret": "****9f2c",
      "lastTriggeredAt": null,
      "createdAt": "2025-02-25T08:00:00.000Z",
      "updatedAt": "2025-02-25T08:00:00.000Z"
    }
  ],
  "total": 1,
  "limit": 50,
  "offset": 0
}

Register a webhook

POST/api/v2/sites/{siteId}/webhooksscope: write

A 32-byte hex signing secret is generated server-side and returned IN FULL only in this response, alongside `secretRevealed: true`. Store it immediately — every later read returns `****<last 4>` and the secret cannot be re-issued.

Viewers receive 403.

Path parameters

siteId

string

The Mongo _id returned as `siteId` by GET /api/v2/sites, or the public `trackingId` embedded in the tracking snippet. Both are accepted everywhere.

Request body

Field	Type	Required	Description
url	string (URL)	Yes	Destination URL. Must be a valid absolute URL.
events	Array<'pageview' \| 'goal_completed' \| 'alert_triggered'>	Yes	Events to subscribe to. At least one.
enabled	boolean	No	Start enabled or paused.

Example request

curl -X POST "https://analytics.appfor.you/api/v2/sites/6507f1f77bcf86cd799439011/webhooks" \
  -H "Authorization: Bearer $ANALYTICS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "url": "https://hooks.example.com/analytics", "events": ["goal_completed", "alert_triggered"] }'

Example response (201)

{
  "webhookId": "6512ee05bcf86cd7994390e5",
  "siteId": "6507f1f77bcf86cd799439011",
  "url": "https://hooks.example.com/analytics",
  "events": ["goal_completed", "alert_triggered"],
  "enabled": true,
  "secret": "b7c1e0a4d29f4f5c8a3b1d6e0f2a7c519f2c",
  "secretRevealed": true,
  "lastTriggeredAt": null,
  "createdAt": "2025-03-21T09:00:00.000Z",
  "updatedAt": "2025-03-21T09:00:00.000Z"
}

Get a webhook

GET/api/v2/sites/{siteId}/webhooks/{webhookId}scope: read

The signing secret is masked as `****<last 4>`.

Path parameters

siteId	string	The Mongo _id returned as `siteId` by GET /api/v2/sites, or the public `trackingId` embedded in the tracking snippet. Both are accepted everywhere.
webhookId	string	Identifier of the webhook.

Example request

curl -H "Authorization: Bearer $ANALYTICS_API_KEY" \
  "https://analytics.appfor.you/api/v2/sites/6507f1f77bcf86cd799439011/webhooks/6512ee05bcf86cd7994390e5"

Example response

{
  "webhookId": "6512ee05bcf86cd7994390e5",
  "siteId": "6507f1f77bcf86cd799439011",
  "url": "https://hooks.example.com/analytics",
  "events": ["goal_completed"],
  "enabled": true,
  "secret": "****9f2c",
  "lastTriggeredAt": "2025-03-19T14:02:00.000Z",
  "createdAt": "2025-02-25T08:00:00.000Z",
  "updatedAt": "2025-02-25T08:00:00.000Z"
}

Update a webhook

PATCH/api/v2/sites/{siteId}/webhooks/{webhookId}scope: write

At least one field is required. `events` replaces the whole list. The signing secret is immutable and is never echoed back unmasked.

Viewers receive 403.

Path parameters

siteId	string	The Mongo _id returned as `siteId` by GET /api/v2/sites, or the public `trackingId` embedded in the tracking snippet. Both are accepted everywhere.
webhookId	string	Identifier of the webhook.

Request body

Every field is optional, but at least one must be supplied.

Field	Type	Required	Description
url	string (URL)	No	New destination URL.
events	Array<'pageview' \| 'goal_completed' \| 'alert_triggered'>	No	Full replacement subscription list, at least one item.
enabled	boolean	No	false pauses deliveries.

Example request

curl -X PATCH "https://analytics.appfor.you/api/v2/sites/6507f1f77bcf86cd799439011/webhooks/6512ee05bcf86cd7994390e5" \
  -H "Authorization: Bearer $ANALYTICS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "events": ["goal_completed"] }'

Example response

{
  "webhookId": "6512ee05bcf86cd7994390e5",
  "siteId": "6507f1f77bcf86cd799439011",
  "url": "https://hooks.example.com/analytics",
  "events": ["goal_completed"],
  "enabled": true,
  "secret": "****9f2c",
  "updatedAt": "2025-03-21T09:40:00.000Z"
}

Delete a webhook

DELETE/api/v2/sites/{siteId}/webhooks/{webhookId}scope: adminDestructive

Requires `confirm=<webhookId>` as a query parameter or a `confirm` body field. The signing secret is lost with the record. Consider `enabled: false` via PATCH instead — it is reversible.

Irreversible. Requires the admin scope and confirm={webhookId} — see Destructive operations.

Viewers receive 403.

Path parameters

siteId	string	The Mongo _id returned as `siteId` by GET /api/v2/sites, or the public `trackingId` embedded in the tracking snippet. Both are accepted everywhere.
webhookId	string	Identifier of the webhook.

Query parameters

Name	Type	Description
confirm	string	Destructive-operation confirmation. Must exactly equal the `webhookId` in the URL. May be sent as a `confirm` field in the JSON body instead.

Request body

Optional — send `{ "confirm": "<webhookId>" }` instead of the query parameter if you prefer.

Field	Type	Required	Description
confirm	string	No	Must equal the webhookId in the URL.

Example request

curl -X DELETE "https://analytics.appfor.you/api/v2/sites/6507f1f77bcf86cd799439011/webhooks/6512ee05bcf86cd7994390e5?confirm=6512ee05bcf86cd7994390e5" \
  -H "Authorization: Bearer $ANALYTICS_API_KEY"

Example response

{
  "deleted": true,
  "webhookId": "6512ee05bcf86cd7994390e5"
}