CookielessOpen sourceSees AI traffic

Web analytics.
Private by design.
Open by default.

Q: How can you count unique visitors without cookies?

Each hit is hashed as SHA-256(daily_salt ‖ site_id ‖ ip ‖ user_agent). The salt rotates at 00:00 UTC per site and the IP is dropped immediately after hashing. That gives accurate daily uniques and makes cross-day tracking impossible by design.

Count visitors without cookies, fingerprints, or stored IPs. A 1 KB script, a server you can read, and a public manifest of what is kept.

Request early access Live demo GitHub

AGPL server · MIT tracker · docker compose up

Drop-in for

Next.js
Express
Hono
Cloudflare Workers
Node http
Ollama
MCP
Docker Compose
Postgres
Supabase Auth

Privacy by design

Not a promise. A manifest.

No cookies, no fingerprints, no stored IP addresses — and you do not have to take our word for it. Every site publishes a machine-readable statement of what is stored, how visitors are counted, and which questions the system cannot answer. Your users, your auditors, and your own agents can fetch it at /api/sites/{domain}/manifest.

Stored

Page pathtraffic reports
Referrer hostattribution — host only
UTM parameterscampaigns
Country / regionIP discarded after lookup
Device · browser · OSdevice reports
Event name + propsgoals
Actor + AI sourceAI traffic
Visitor hashunique for one UTC day

Never stored

IP address
Cookies
localStorage identifiers
Fingerprints
Cross-site identity

Cannot answer

Who a visitor is
Whether they came back after midnight UTC
Cross-site or cross-device identity
Exact address (city is off by default)
Anything about visitors who block the request

Collection manifest · public

GET /api/sites/example.com/manifest

{
  "name": "Vector 5 Analytics",
  "site": "example.com",
  "cookies": false,
  "local_storage": false,
  "fingerprinting": false,
  "ip_stored": false,
  "visitor_hash": "sha256(daily_salt || site_id || ip || user_agent); salt rotates 00:00 UTC",
  "retention_days": 730,
  "fields": ["path", "referrer_host", "utm", "country", "device",
             "browser", "os", "actor", "ai_source", "event_name"],
  "cannot_know": [
    "Who a visitor is",
    "Whether they returned after midnight UTC",
    "Cross-site or cross-device identity",
    "Exact address or city",
    "Anything about visitors who block the request"
  ]
}

How a visitor is counted

visitor_hash = SHA-256(daily_salt ‖ site_id ‖ ip ‖ user_agent)

The salt rotates at 00:00 UTC per site. After hashing, the IP is dropped. A visitor who returns tomorrow is counted as new — on purpose. There is nothing to subpoena, leak, or sell.

Read the full privacy model

Open source

AGPL server. MIT edges. Clean room.

Read every line that touches a visitor. The server and dashboard are AGPL-3.0 so improvements flow back; everything you embed in your own product is MIT so it never constrains you.

View on GitHub privacy-model.md

apps/api
Go · ingest, classification, rollups, insights
AGPL-3.0
apps/web
Next.js · landing and dashboard
AGPL-3.0
packages/tracker
1 KB cookieless v5.js
MIT
packages/middleware
Next · Express · Hono · Workers · Node
MIT
packages/mcp
Read-only MCP server
MIT
packages/skills
Prompts for Claude, Cursor, Codex
MIT

Self-host in one command

terminal

git clone https://github.com/vector5-ai/analytics
cd analytics
cp .env.example .env
docker compose up --build

# Dashboard  http://localhost:3000
# API        http://localhost:8080

Or run it in the cloud

Same code, hosted for you, with Supabase auth. The manifest is identical either way — your privacy claims do not depend on where the server lives.

Not a fork

Vector 5 was written from scratch. It is not affiliated with Plausible Analytics and does not reuse their code, name, or assets.

How it works

Two lines of code. Three kinds of visibility.

The browser script counts people. The server middleware counts everything that never runs JavaScript. The dashboard — and your agents — read both.

Add the script

A 1 KB tracker with no cookies, no localStorage identifiers, and no fingerprinting. It sends the page, the referrer host, UTM parameters, and a screen width. That is the whole payload.

1 KB
MIT
No cookie banner required

index.html

<script defer data-domain="example.com"
  src="https://analytics.example.com/js/v5.js"></script>

Add the middleware

Crawlers and agents never load your script. One middleware forwards their requests — user agent, path, referrer — to your Vector 5 instance. By default only non-human actors are recorded; set recordHumans for no-JS sites.

Next.js
Express
Hono
Workers
Node

middleware.ts

import { vector5 } from '@vector5/middleware/next'

export const middleware = vector5({
  endpoint: 'https://analytics.example.com/api/hit',
  domain: 'example.com',
})

Read it — or let your agent

Open the dashboard, or point Claude, Cursor, or Codex at the MCP server. Six read-only tools: stats, pages, sources, AI traffic, goals, insights. Same aggregates the dashboard sees, nothing more.

Dashboard
MCP server
Agent skills

.mcp.json

{
  "mcpServers": {
    "vector5": {
      "command": "npx",
      "args": ["@vector5/mcp"],
      "env": {
        "V5_API_URL": "https://analytics.example.com",
        "V5_API_KEY": "v5_live_…",
        "V5_SITE_ID": "example.com"
      }
    }
  }
}

And then, AI traffic

Browser-only analytics is blind.

Privacy and open source get you a tool you can trust. Vector 5 also fixes what those tools cannot see: GPTBot, ClaudeBot, and PerplexityBot never execute JavaScript, and people who click a citation inside ChatGPT usually arrive with no referrer. Every other privacy-first tool files all of it under Direct — or never sees it at all.

What most tools report

browser only

Same week. 9,204 “visitors”.

Direct41%
Google33%
Twitter9%
Reddit6%
Other11%

Not visible

3,902 crawler fetches by GPTBot, ClaudeBot, PerplexityBot and OAI-SearchBot. 214 headless agent sessions. 1,731 humans referred by an assistant.

What actually happened

Vector 5

Same week. Every actor named.

Google33%
Direct19%
ChatGPT14%
Twitter9%
Perplexity6%
Reddit6%
Claude · Gemini2%
Other11%

ai_crawler

3,902fetches

human_via_ai

1,731visitors

ai_agent

214sessions

Illustrative numbers. Vector 5 never invents visitors — see the honest empty state on the live demo.

Actors

Every event has an actor.

Vector 5 tags each hit with who — or what — produced it, then lets you filter every report by that field. Humans stay clean. AI becomes visible.

human

A person in a browser

Counted with a hash that rotates every UTC midnight. Never a cookie, never a fingerprint, never a stored IP.

Detected by: v5.js · 1 KB
Examples: Chrome, Safari, Firefox …

human_via_ai

A person sent by an assistant

Arrived from ChatGPT, Perplexity, Claude, Gemini, Copilot, Grok or DeepSeek — via referrer or utm_medium=ai_search. Its own channel, not “Direct”.

Detected by: Referrer host + UTM rules
Examples: chatgpt.com, perplexity.ai, claude.ai …

ai_crawler

A model fetching your pages

Training and search crawlers that never run JavaScript. Recorded server-side with the page they fetched, so you know what the models have read.

Detected by: Server middleware · UA match
Examples: GPTBot, ClaudeBot, PerplexityBot, OAI-SearchBot, Google-Extended …

ai_agent

A headless agent on a task

Automation acting on someone’s behalf: browsing, comparing, buying. Kept apart from humans so your conversion rates stay true.

Detected by: Headless signatures · no JS executed
Examples: Playwright, Puppeteer, crawl4ai, agent UAs …

bot

Everything else automated

Uptime monitors, link previews, generic spiders. Excluded from every human metric by default.

Detected by: Generic bot list
Examples: Pingdom, Lighthouse, facebookexternalhit …

Filter everything

One dropdown. Every report.

Visitors, pages, sources, countries, devices, goals — each one answers for humans, humans via AI, crawlers, agents, or all actors.

human

human_via_aiselected

ai_crawler

ai_agent

all

AI insights

The model sees aggregates. Never a visitor.

Weekly insights are generated from rollups — counts, ratios, deltas — and nothing at the event level ever leaves the database. Run it on Ollama and nothing leaves your server at all.

Ollama · local
OpenAI
Anthropic
Gemini
Any OpenAI-compatible

Anomaly detection runs alongside: a sudden crawler spike or an assistant referral surge shows up as a flag, not a paragraph you have to hunt for.

Model input · aggregates only

// Everything the model receives. Nothing else.
{
  "period": "2026-08-31 → 2026-09-06",
  "visitors": { "human": 12480, "human_via_ai": 1731, "delta_wow": 0.08 },
  "ai_referrals": { "chatgpt": 1190, "perplexity": 402, "claude": 139 },
  "crawlers": { "GPTBot": 2210, "ClaudeBot": 980, "PerplexityBot": 712 },
  "crawl_to_referral": [
    { "page": "/pricing", "crawled": 340, "referred": 2 },
    { "page": "/docs/middleware", "crawled": 128, "referred": 61 }
  ]
}

Weekly insight

llama3.2 · ollama

Assistant referrals grew 38% week over week; ChatGPT alone now sends more visitors than Reddit and Twitter combined. GPTBot fetched /pricing 340 times but it produced only 2 referred humans — the page is being read, not cited. /docs/middleware converts crawls to referrals at 48%; consider giving pricing the same structure: a clear first paragraph, schema.org markup, and a stable title.

Generated from 7-day aggregates. No visitor-level data was used.

Everything else

The reports you expect. Plus the ones nobody else has.

Vector 5 is a complete replacement for your current privacy-first tool — and then it keeps going.

Crawl → referral

See which pages AI crawlers fetch, and which of those pages later send you humans. Cited-but-never-clicked becomes a list, not a guess.

pagecrawledreferredrate

/docs/middleware1286148%

/blog/cookieless962223%

/compare210199%

/pricing34021%

Realtime

People on your site in the last five minutes — humans and humans via AI only. Crawlers never inflate the live number.

Right now

Goals & custom events

Name an event, pass optional props, filter by actor. Conversion rates that agents cannot distort.

// Custom event with props
window.v5('signup', { plan: 'pro' })

// Ignore your own visits
localStorage.v5_ignore = '1'

Campaigns & geo

UTM parameters as first-class dimensions — utm_medium=ai_search is recognised as an assistant channel. Country and region from the IP, then the IP is gone.

utm_source
utm_medium
utm_campaign
country
region
device

Agents read it too

An MCP server and a set of agent skills: audit crawler access, find cited-but-not-clicked pages, write the weekly founder briefing — from observed numbers only.

query_statsread-only
top_pagesread-only
sourcesread-only
ai_trafficread-only
goalsread-only
insightsread-only

Public crawler index

A live, public list of every AI crawler Vector 5 recognises and the source it maps to — GPTBot → ChatGPT, ClaudeBot → Claude, Google-Extended → Gemini. Useful even if you never install anything.

GET /api/crawler-index

Import. Export. Leave.

Bring history in from CSV. Export every aggregate as JSON whenever you like. Your data is yours; the schema is documented in the repo.

POST /import · GET /export

Compare

Honest differences.

Vector 5 is a clean-room product, not a fork. Here is where it is the same as the tools you know, and where it is not.

Full comparison

	Vector 5	Plausible-class	Umami / Rybbit-class	Google Analytics
Actor on every event	Yes	No	No	No
AI crawler reports (GPTBot, ClaudeBot, PerplexityBot…)	Yes	No	No	No
Server-side middleware for non-JS visitors	Yes	No	Rare	Server-side GTM
Public collection manifest per site	Yes	No	No	No
AI insights from aggregates only	Yes	No	Chat on raw data	Yes, Google-hosted

FAQ

Questions people actually ask.

Do I need a cookie banner?

Vector 5 sets no cookies and writes no identifiers to localStorage, so it does not trigger the consent requirements that cookie-based analytics do. Unique visitors are counted with a salted hash that rotates daily and cannot be reversed. As always, confirm with your own counsel for your jurisdiction — and hand them the manifest.

How can you count unique visitors without cookies?

Each hit is hashed as SHA-256(daily_salt ‖ site_id ‖ ip ‖ user_agent). The salt rotates at 00:00 UTC per site and the IP is dropped immediately after hashing. That gives accurate daily uniques and makes cross-day tracking impossible by design.

How do you see AI crawlers if they never run JavaScript?

Through the server middleware. It runs inside your application (Next.js, Express, Hono, Cloudflare Workers, or plain Node), inspects the user agent, and forwards non-human requests to your Vector 5 instance. Crawlers are recorded with the exact page they fetched.

What exactly is human_via_ai?

A person who arrived from an AI assistant. Vector 5 recognises referrers from chatgpt.com, perplexity.ai, claude.ai, gemini.google.com, copilot.microsoft.com, grok.com and chat.deepseek.com, plus utm_medium=ai_search / ai-assistant and utm_source values like chatgpt or perplexity. Assistants often strip referrers, so the true number is likely higher — Vector 5 never guesses to fill the gap.

Does the AI insights feature send my data to a third party?

Only aggregates — counts, ratios, week-over-week deltas — are ever passed to a model, and only if you turn insights on. Point it at Ollama and nothing leaves your server. OpenAI, Anthropic, Gemini and any OpenAI-compatible endpoint are also supported.

Is Vector 5 a Plausible fork?

No. It is a clean-room implementation in Go and TypeScript. It is not affiliated with Plausible Analytics and uses none of their code or assets. The comparison page names them only to be honest about where the products overlap.

What does it cost to self-host?

Nothing. The server and dashboard are AGPL-3.0; the tracker, middleware, MCP server and skills are MIT. Run docker compose up, point your DNS at it, and add the script. Hosted Vector 5 is invite-only early access — request a seat from the homepage if you would rather not operate Postgres yourself.

Can I migrate my existing data?

Yes. Import historical aggregates from CSV, and export everything as JSON at any time. There is no lock-in and the schema lives in the repository.

Early access

Signup is closed. Request a seat.

Vector 5 is in private early access. Leave your email — we invite people in small batches. No account is created until then.

Self-host from GitHub

Invite only · No public signup · No credit card

Web analytics.Private by design.Open by default.

Not a promise. A manifest.

AGPL server. MIT edges. Clean room.

Two lines of code. Three kinds of visibility.

Add the script

Add the middleware

Read it — or let your agent

Browser-only analytics is blind.

Every event has an actor.

A person in a browser

A person sent by an assistant

A model fetching your pages

A headless agent on a task

Everything else automated

The model sees aggregates. Never a visitor.

The reports you expect. Plus the ones nobody else has.

Crawl → referral

Realtime

Goals & custom events

Campaigns & geo

Agents read it too

Public crawler index

Import. Export. Leave.

Honest differences.

Questions people actually ask.

Signup is closed. Request a seat.

Web analytics.
Private by design.
Open by default.