Umami is a simple, fast, privacy-focused alternative to Google Analytics
github.com
github.com
I've been in this space for ~3 1/2 years, so if you have any questions, please let me know :)
[0] https://european-alternatives.eu/category/web-analytics-serv...
> Because it does not use cookies their is no need to show cookie banner for this service.
This is IMO a rather fundamental misunderstanding of the current situation.
I'd be hesitant to using a product from someone who I think have misunderstood completely what the rules are about. (Again, IMO and also IANAL but I have followed GDPR more closely than most people.)
GDPR is about collection information, as far as I can see, the technical detailsbof how you do it doesn't matter. It could be pure magic and would still be illegal.
The response from Plausible is essentially "we've checked with legal council, and stand by the statement". The conversation with the lawyer started out well, but he stopped responding when I asked about the ePD, not GDPR.
There generally seems to be a lot of confusion, even in legal circles, about what ePD requires informed consent for. Many think that only PII requires consent, or think that anonymization bypasses it. That amount of confusion makes it very easy for a layman (e.g. Plausible) to find _someone_ willing to back up their viewpoint.
The EDPB released a guideline in 2023 that explicitly states that what Plausible et al. are doing is covered by the ePD's consent requirement, but that's a little too late: the implementations in member countries already differs massively on whether it's covered[4].
1: https://github.com/plausible/analytics/discussions/1963 2: https://plausible.io/blog/legal-assessment-gdpr-eprivacy 3: https://news.ycombinator.com/item?id=42792485 4: https://matomo.org/faq/general/eprivacy-directive-national-i...
That seems to be true, going by this comment section and the other ones I've seen.
It's hard to get a non-hyperbolic answer to the question: if everyone is so confused, what's the real-world consequence of best-effort implementation?
Some would say it's the ultimate responsibility of the app owner to understand the law, but how much further can you go than hiring a lawyer?
If more diligence needed to be done than that none of us would get anything built, we'd all just be running around researching the laws around these dumb popups.
What are the real-world consequences of making a mistake here? What kind of boundary would you have to trip over to actually get the authorities to prosecute you for not having a consent popup or doing it badly?
I have recently gone through a conversation with a client that has been told in NY state (in the US) that something similar to GDPR is coming for those that deal with PII. Both the client and the agency I work for have added various scripts to the website for dynamic forms, tracking (Google Analytics), and newsletter functionality. It's at a point where everything that is 3rd party has to be discovered first, then seeing if there is the ability to anonymize everything (either by default, or with a user consent dialog). Even with current laws, it seems intentional to keep things vague.
We (I'm in the US) badly need clarifying regulation. Until then, compliance will mainly be about preventing yourself from being low-hanging fruit for opportunistic litigation - which, to be clear, can generate productive results, but is clearly inefficient.
> No need for cookie banners or GDPR consent
>
> Plausible is privacy-friendly analytics. All the site measurement is carried out absolutely anonymously. Cookies are not used and no personal data is collected. There are no persistent identifiers. No cross-site or cross-device tracking either. Your site data is not used for any other purposes. All visitor data is exclusively processed with servers owned and operated by European companies and it never leaves the EU.We have done a privacy risk analysis with an external lawyer and data protection officer, and concluded that Pirsch is in line with GDPR as we do not collect nor store personal identifiable information (PII). Processing stuff like IP addresses for example is legal as long as they are not stored and only cached for a reasonable amount of time (a few milliseconds in our case).
If you're interested, we have extensive documentation on this. You can reach out to support@pirsch.io to get it :)
If anyone is interested in doing something similar. This did cost us about 8,000 € in Germany.
The apparently extensive legal assessment you just described costed just 8'000 euro?
I am sorry but that had to be some hasty review at best. Do you take the full legal risk in case any of your customers would be found in violation of privacy laws because of using your service?
For reference, with similar hourly rates as Germany, reviewing a standard apartment-purchase contract cost me ~3500 euro.
Imagine starting a business in Germany. How are you suppose to pay 30-50k for legal questions before selling anything?
The moment someone sues your customers, or some European agency will gets onto them, that 8000 euro opinion is all you're basing your company's legal security on. In that context, yes, this is being very cheap.
Let's assume I pay $1000 for Google Search Ads, wouldn't it help the business to know that "from my sales, $800 came from Google Search Ads"?
People do this all the time, even in real life, with coupon codes fliers for example.
Plausible doesn't store visitor's IPs or any other PII, and doesn't set any cookies. The reasoning given in the quoted paragraph is incomplete, but the result is correct. You only need to mention them in your privacy policy, they don't require any opt-in popups
Personally identifiable information has nothing to do with javascript, or analytics. Do you have GET requests with parameters containing enough to identify a specific individual? Then your logs are sensitive and you must have a valid contract, informed consent, or provide some important service where this information is necessary.
There are gray areas which can make this difficult, but you the basic idea is enough information to identify an individual. A basic website where you log that IP address A viewed home.html is not enough. The knowledge that a 55 year old woman with particular name on a particular street address has an interest in photograhy and shoe size 9 probably is. The line is somewhere in between.
> The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.
So details definitely matter. Some self-hosted analytics do this by getting rid of the last octet of the IP address, though I doubt that's been tested in courts.
> This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.
There is no ambiguity here, aggregate data is completely fine as long as I can't trace it back to you with a reasonable amount of effort.
what I mean is you can track unique visitor of your app without privacy breach because you use anonim data
But of you can still find a way to identify users from server logs, then probably yes.
I basically started this for my personal use as a library for Go, which it still is:
https://marvinblum.de/blog/server-side-tracking-without-cook...
i tried a couple of the smaller analytics tools, like plausible, simpleanalytics, umami etc... and one thing that i always disliked was the way the session duration was calculated - i have a lot of longer articles where the visitor stays for a long time and then leaves. most of these tools will count that as a bounce, as there is no two hits to calculate the delta between. but for me it is a very important metric to get accurate numbers on, which is impossible with that implementation for sites like mine (very few but long page visits, not a lot of navigation between pages).
do you handle this the same way? that would be a feature i'd be willing to switch my current tool out for.
a native mobile app is a gigantic time, productivity, and cash investment. if a business can get most of the value from a PWA, they will be far better off investing that time and innovation into other parts of their business than building a native app for the "smoothness"
If you would like to self-host or have other specific requirements, you can quickly reduce the list to a couple of options of course.
- Generated insights — https://bizarre.gg/meta
- Show detailed interactive gameplay logs (from "Umami" analytic events) — https://bizarre.gg/runs/00493ccf-5b96-523c-beb4-06e8154cc158
Thread w/ development overview: https://news.ycombinator.com/item?id=43080066
I used Umami and mention it in the video. Admittedly, it was a mistake for my use case. I had to heavily modify Umami due to lack of features and performance issues. There are a also lot of bugs in the project which are immediately revealed simply by enabling TypeScript strict flags, and some more linting rules. Granted, I was not really using Umami exactly as intended. I do think it's great this project exists, and whilst I had to heavily modify it for my use case, I did at least help the upstream project diagnose one issue: https://github.com/umami-software/umami/pull/2946#issuecomme...
That's not very friendly of them.
Now it appears they have built an entire team and raised some VC to build out their SaaS.
Is that the case? Just FYI there was a scam claiming to be them and raising funds about Web 3 and Crypto.
It's an incredibly bare-bones analytics tracker, but it's free and cloud-hosted which were the two things I was most looking for in an alternative to GA.
I run a website that gets about ~300k pageviews/month. Vercel was eating my wallet alive with their analytics offering. All I wanted with my tracker was to feel motivated by knowing that traffic was going up and to the right. I didn't want to pay hundreds a month for that and I didn't want to manage my own server just to have analytics. Goatcounter addressed my needs well!
I wonder why that is? My suspicion is this is layout is becoming a "standard UI" for analytics software. Often times I see companies in the same space largely mimic each others UI's. Things like the "Find Care" option in most healthcare sites looks largely the same. Same thing goes for LLM frontends and time tracking software. It just seems that each team has individually come to the same conclusion about what the "best UI" is for a given task.
Umami Demo - https://eu.umami.is/share/LGazGOecbDtaIwDr/umami.is
Simple Analytics Demo - https://dashboard.simpleanalytics.com/simpleanalytics.com
Fathom Analytics Demo - https://app.usefathom.com/share/deasaicp/hilarious+platypus?...
In this case the value prop is in the open source, self host, privacy first. Why try to innovate on the UI?
I just hate the idea that I have to install an entire package manager simply to use some Node.js code, when NPM almost certainly could have done the job.
There's also a Docker option if you don't want to do that.
There’s a reason there’s 3 popular package managers for Node that aren’t NPM. Yes, part of that is the culture/ecosystem, but not entirely.
Being bad thereby creating desirable competition has lasting effects. We could get into when/why/what each thing supports all day, but it's not worth it.
Speaking of what's supported nowadays, installing other package managers is a corepack call away -- literally a whole other feature built into Node.js because NPM is/was/etc subpar. It's experimental, but this is all to say: it doesn't surprise me in the slightest that a project might use something that isn't NPM, and I actively expect it when picking up other's projects.
https://news.ycombinator.com/item?id=24198329 aug-2020 227 comments
https://news.ycombinator.com/item?id=27181622 may-2021 42 comments
https://news.ycombinator.com/item?id=31284853 may-2022 42 comment
https://news.ycombinator.com/item?id=24184773 aug-2020 9 comments
https://news.ycombinator.com/item?id=24422333 sept-2020 3 comments
Surprisingly, Umami has been handling our traffic volume without breaking a sweat on much smaller instances. I suspect PostgreSQL's superior handling of concurrent writes plays a big role here compared to MySQL/MariaDB. Except for the team/user management, everything feels much nicer on Umami.
Shameless plug: As part of the migration, I also took the opportunity to learn some Rust by writing a small utility that uses the Umami API to generate daily/weekly analytics reports and sends them via email[1]. Pretty happy with how it turned out, though I'm still learning Rust so any feedback or suggestions for improvement are welcome!
In my experience, MySQL still runs very well until you have 10-20m rows (on a single machine, like 8vCPU and 32GB RAM), after it gets trickier to get instant responses.
You’re right about MySQL performing alright for 10-20m rows, but from our perspective those numbers are not that big for a company this size.
Yeah, it's hard to run aggregate queries on MySQL once you are talking about hundreds of millions of rows, or billions. Even though, if the server has modern CPU, enough RAM to store the entire DB and NVMe storage, it's still okish with the right indexes and if the queries are optimized.
Thanks for sharing!
For plausible I believe that since it runs on Postgres, scaling should not be a problem as long as you scale the resources with it.
Things would hopefully be even better once clickhouse support lands.
A "privacy-focused" solution (not that software that's specifically made for spying can be "privacy-focused". Let's call a spade a spade: it's spyware) would at least use standard endpoints to make it easy for users to opt-out by blocking those endpoints. In this way, GA is actually more privacy friendly.
"Some lists can be overly agressive" is also a bad attempt at gaslighting. Your software watches the way I browse, including tracking purely client-side events and outbound links (see "journeys"). You attempt to track things like device characteristics and what operating system I use. That's creepy and voyeuristic to me, and is exactly what spyware blockers are for.
Actual privacy-friendly analytics looks more like the Steam hardware & software survey where they ask if you'd like to tell them these things, and show you exactly what they are going to collect.
So all in all: total fan, otherwise I wouldn't be using it, but it's fairly limited in what it can do.
There is more I'd come up with if I actually pulled it up, but the overall throughline is that it just feels 'too basic' at this moment. Especially for something that goes beyond tracking visits on your personal blog and/or hobby website.
Would it not be better to just have a blacklist it could ignore localhost and whatnot?
https://umami.is/ https://eu.umami.is/share/LGazGOecbDtaIwDr/umami.is
And if it is, is there that notable an influx?
Zoom out to 90 days, and then today doesn’t seem much different from any other day.
Why can't people be more creative with finding good names? Salt? X? Yes, Apple is a terrible name too, but at least it was historically called Apple Computers and only changed once they had a huge brand already.
The migration would never be total, though, because more than a few users had copied the analytics script to their CDN or were in some way depending on a local fork of it. Some backwards compatibility would need to be maintained, perhaps for as long as the product exists. For this and other reasons, changing the params (and supporting both, indefinitely) wasn't pursued.
Also there is a nice python library for calling the functions directly: https://github.com/mikeckennedy/umami-python
I do wish it would track bot traffic though. My site of 10m pages is heavily crawled by bots and I wish I could keep track of them a bit more.
See https://umami.is/docs/environment-variables#:~:text=DISABLE_...
For a long time, may be at least 2-3 years it was simply an open source, use as you please MIT software with no hosting offering. I remember when it launch the first thing I notice was the graphics design was so much better than other offerings. While I was interested at the time, I ultimately went with plausible. Mostly because it seems to have a sustainable backing, and another major reason was the usage of ClickHouse. If you want best resources usage / scale / performance analytics I don't think there are many other choices. A lot of other solutions, including pleasurable settled on clickhouse as well.
I have recently went to check on them again and looks like things have progressed a lot. They have hosting offering and they are also working on Clickhouse integration.
Between Urchin, Reinvigorated, and another one I can remember its name, it's been a long time I am excited about analytics. I just hope if Mcao read this. Congratz and well done .
There needs to be a convincing explanation of how google style analytics can be privacy focused, otherwise I disregard this as a clone with feel good branding
2) who gives a shit, genuinely who cares about cookies?
3) so it's privacy oriented in that the dev doesn't send their data to google, but users send their data to someone anyways? And why would sending data to a self hosting rando be safer than sending it to google from a user and security perspective?
Did you read the recent article about how reCAPTCHA is used for tracking you across the internet? I have no reason to believe GA isn’t similar. And just think about how much info they have on you from reading all of your emails.
If I'm going to a site, I'm willingly sharing some of my personal data with that site. I'm not implicitly consenting to third parties harvesting my data.
How is it typically done without cookies then?
> any probabilistic approach is either relatively inaccurate reduces it's usefulness for this use case, or accurate which raises the same identifiability concerns cookies would introduce
How so? Even if it's accurate you wouldn't be storing anything the information (random id or fingerprint) for the individual user, so you would only be able to answer with reasonable certainty whether you saw the user before or not. You can't identify anyone from that (other than identify them as a new vs returning user) so there is no identifiability concern, unless of course one thinks that constitutes a concern in itself which I don't think the GDPR does.
And yes what you said is exactly right; you're allowed to fingerprint a unique user and track data with that fingerprint as the sole unique identifier without any PII legislation (GDPR, CCPA, etc.) compliance issues. You just cannot store any information that allows linking PII data to that fingerprint in either direction. In other words, attribution to a random UUID that just happens to represent an anonymous user is not an issue.
Circling back to the original comment; there is no (good) argument against cookies if you're basically doing exactly what cookies are doing. Umami using it as a USP is, at best, a little odd.
That is not true. E.g.
1. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs...
2. https://ico.org.uk/for-organisations/direct-marketing-and-pr... specifically https://ico.org.uk/for-organisations/direct-marketing-and-pr...
This is for the UK, I am not up to date with other European regulators.
I don't think this is correct, or at the least it's unfortunately phrased. If your fingerprint is so specific that it can distinguish unique users, it is covered under GDPR compliance. I don't know too much about the CCPA so not sure if it's the same there.
Yes, you are allowed to collect device statistics such as form factor, viewport size etc. But if you can distinguish between two different users with identical devices accessing your site at the same time, under GDPR you have an obligation to inform [14]. And if you can recognize a returning user across sessions, you also need consent.
I suspect what's happening here is that the word "user" is making things ambiguous here. It was meant in the context of attributable session, not as the data subject as per GDPR language for example.
https://law.stackexchange.com/questions/82133/are-auto-gener...
TL;DR: They derive an identifier from IP address and User Agent using an hash, allowing them to have a tracking identifier without storing Personal identifiers (the IP address)
My IP and UA don’t change, pretty much ever.
I can delete a cookie anytime I want.
First Umami was being blocked by all ad blockers and it caused my web app to crash, then I had to use some workaround which allowed it to work with ad blockers but stopped my Express app from sending responses back to the frontend.
It irritated me so much, because there is not enough documentation for it, although I did find multiple people reporting something similar like me. I just called quits on it, analytics shouldn't be that complex to setup if you are not self-hosting, the Vercel one is serving me okayish for now.
Would recommend.
drizzle.team is alway delivering.
Bot traffic is significant and I've noticed different vendors have varying degrees of success filtering out bots versus humans.
Nobody cares how Umami interacts with their site, because nobody's heard of it.
I'm seeing a trend of slapping a random simple Japanese word to a new project without explanation. Maybe it doesn't need one but at least it would make the name more memorable to me.
Or at least change the spelling to accomplish the same goal. Whats wrong with Oomami or Umaami to make it easily identifiable on the web?
[1] - https://github.com/qarmin/czkawka [2] - https://github.com/qarmin/szyszka [3] - https://github.com/kopia/kopia
That's all what I can remember. I wouldn't count KDE apps that do sound Polish or Slavic just because they "had" to replace initial letter with K to keep the leading theme.
Then people behind MATE desktop on the other hand named apps in their project using Spanish words, e.g. file manager Caja - "box" or "case", documents reader Atril - "lectern" or "music stand"
As for Japanese words usage, it's still the outcome of anime&manga wave that bloomed in the end of 90s. What I find surprising is that nothing comparable happen when k-pop and k-dramas rise to popularity - there's a significant fascination of South Korean culture but not as intensive that would show interest in using vocabulary in the West as that happens with Japan. Perhaps mukbang, "eating broadcast" is the only exception.
By the way I have a single Japanese word named project, but it's related to the language, and that name has two other connections with the project content.
It's basically bankrupted creativity.