10 ms·

Creator here. As a developer, I install analytics for clients, but I never feel comfortable installing Google Analytics because Google creates profiles for thei

Creator here. As a developer, I install analytics for clients, but I never feel comfortable installing Google Analytics because Google creates profiles for their visitors, and uses their information for apps (like AdWords). As we all know, big corporations unnecessarily track users without their consent. I want to change that. So I built Simple Analytics. To ensure that it's fast, secure, and stable, I built it entirely using languages that I'm very familiar with. The backend is plain Node.js without any framework, the database is PostgreSQL, and the frontend is written in plain JavaScript. I learned a lot while coding, like sending requests as JSON requires an extra (pre-flight) request, so in my script I use the "text/plain" content type, which does not require an extra request. The script is publicly available (https://github.com/simpleanalytics/cdn.simpleanalytics.io/blob/master/hello.js https://github.com/simpleanalytics/cdn.simpleanalytics.io/bl...). It works out of the box with modern frontend frameworks by overwriting the "history.pushState"-function. I am transparent about what I collect (https://simpleanalytics.io/what-we-collect https://simpleanalytics.io/what-we-collect) so please let me know if you have any questions. My analytics tool is just the start for what I want to achieve in the non-tracking movement. We can be more valuable without exploiting user data.

e12e 8y ago
> The script is publicly available Nice. You might want to add an explicit copyright/license though. Make it less (or more) dangerous for other devs to read it... I think it could actually be quite useful to "standardize" on a simple (open/libre) front end for analytics (with an implied back-end standard).
cutety 8y ago
Just a heads up, HN comments only use a (I think) small subset of Markdown for formatting, but your link will work as is without having to wrap it in [] and adding the (). https://github.com/simpleanalytics/cdn.simpleanalytics.io/blob/master/hello.js https://github.com/simpleanalytics/cdn.simpleanalytics.io/bl... https://simpleanalytics.io/what-we-collect https://simpleanalytics.io/what-we-collect Anyway, cool project! I've always felt the same about using GA given I actually like to pretend I have some sort of privacy these days, and always have an adblocker on, so I hated setting it up for people. Definitely will be keeping an eye on this the next time someone asks me to setup GA.
- harianus 8y ago
  Thanks, I changed it. Glad you can relate!
blondin 8y ago
nice job! i like the direction you are taking with this project. it's still young, so we don't know X) you might get bitten too lol anyways, wish you the best luck with your endeavor. btw you might want to fix links above.
- harianus 8y ago
  Thank you! Fixed the links.
lucideer 8y ago
This look great—have bookmarked it for future projects. I would however a little more skeptical with tools claiming to be privacy-first than I would be with GA (who I presume are not privacy-first). On that note, some quick questions: - Any plans to open source? I've used Piwik/Matomo in the past, and while I'm not a massive fan of the code-quality of that project, it's at least auditable (and editable). - You say you're transparent about what you collect—IPs aren't mentioned on that page[0]. Are IPs stored in full or how are they handled? I assume you log IPs? - How do you discern unique page-views? You seem to be dogfooding and I see no cookies or localStorage keys set. [0] https://simpleanalytics.io/what-we-collect https://simpleanalytics.io/what-we-collect
- harianus 8y ago
  - No plans to go open source with the backend, but I do show the code that is run in the browser. The visualisation of the data is not super important I think. - I don't save IP's, not even in the logs. - I don't have unique pageviews at the moment. I will in the future. If the referrer is the same as the current page, I will measure that as a non-unique. What do you think?
  - always_good 8y ago
    Doesn't seem like a very useful measure of uniqueness. What if you had one-day retention of IP addresses for per-day unique views? Seems like too important of a metric to eliminate completely, and one-day retention seems like a decent trade-off at the expense of being able to do unique analysis over longer time periods.
    - iampims 8y ago
      Don’t retain the IP address, retain a hash of the IP address.
      - detaro 8y ago
        A plain hash doesn't make a difference. One can use hashes with regularly changing salts that are destroyed after a while to make older hashes unusable though for some purposes.
consto 8y ago
This is pretty much exactly what I have been looking for. I recently ditched Google Analytics and all other possible third party resources (except for YouTube which I implemented a click to play system) on my blog (consto.uk). I just have a quick question. What subset of the javascript implementation does the tracking pixel provide? If all that is missing is screen size, I might just choose that to avoid running third party code. For performance, I combine, minify, and embed all scripts and styles into each page which lets me acheive perfect scores in the Chrome Auditor.
- harianus 8y ago
  I practice, you can copy the code to your server. You could subscribe to repo updates on https://github.com/simpleanalytics/cdn.simpleanalytics.io https://github.com/simpleanalytics/cdn.simpleanalytics.io and update your code if the changes make sense to you.
hashr8064 8y ago
Hey I like the idea but have a question. How are you storing all the information that analytics users want to know i.e. (What devices, what languages, what geolocations, what queries, what page navigations and clicks, etc.) After reading what you collect I'm assuming you are doing a lot of JS sniffing of browser properties to gather this information along with IP address analysis is that correct? Or what are you plans about these features if you don't have them now? Overall though I'd say great design + sales pitch. I think if the product delivers on enough features you will have something here. Great job!
- sincerely 8y ago
  It doesn't look like they collect or store languages, geolocations, or devices beyond screen sizes.
  - Drdrdrq 8y ago
    And even if they did, if it is stored as aggregates, I (as a visitor) wouldn't mind.
nhooyr 8y ago
Why would sending requests as JSON require an extra request?
- harianus 8y ago
  Explained here: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS (search for preflight)
wnevets 8y ago
> like sending requests as JSON requires an extra (pre-flight) request, so in my script I use the "text/plain" content type, which does not require an extra request. what are the security implications of this?
- cevn 8y ago
  He's talking about skipping CORS by using a "plain" request. Avoiding CORS is not a huge security vulnerability afaik.
deleted 8y ago
[deleted]
deleted 8y ago
[deleted]
pdkl95 8y ago
> unnecessarily track users without their consent Regardless of your intentions, you are collecting enough data to track users. > I am transparent about what I collect ([URL]) That page doesn't mention that you are also collecting (and make no claim about storing) the globally-visible IP address (and any other data in the IP and TCP headers). This can be uniquely identifying; even when it isn't unique you usually only need a few bits of additional entropy to reconstruct[1] a unique tracking ID. In my case, you're collecting and storing more than enough additional entropy to make a decent fingerprint because [window.innerWidth, window.innerHeight] == [847, 836]. Even if I resized the window, you could follow those changes simply by watching analytics events from the same IP that are temporally nearby (you are collecting and storing timestamps). [1] An older comment where I discussed how this could be done (and why GA's supposed "anonymization" feature (aip=1) is a blatant lie): https://news.ycombinator.com/item?id=17170468 https://news.ycombinator.com/item?id=17170468
- harianus 8y ago
  Good comment! I only store the window.innerWidth metric. I updated the what we collect page (https://simpleanalytics.io/what-we-collect https://simpleanalytics.io/what-we-collect) to reflect the IP handling. We don't store them. And fingerprinting is something that would be definitely tracking, not on my watch!
  - donut 8y ago
    You wrote "Point." - did you mean "Period."?
  - samirm 8y ago
    There is absolutely no reason to collect and store window dimensions, other than for fingerprinting and tracking. Sure it might be an interesting piece of trivia for the dev, but it's not necessary for the dev to "make sure the website works great on all of those dimensions", since that much is already obvious and presumed when making websites these days.
    - soared 8y ago
dylz 8y ago
How can I run this myself? It absolutely isn't privacy-first if it requires running on someone else's machine and giving your users' data to them - another issue would be that while your server is in the EU, the hosting company is subject to US law, and all the stuff that comes with it (https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act f.e.)
- shermozle 8y ago
  Try Snowplow if you want to run it yourself.
ucarion 8y ago
First off: hats off for making a product that takes the rights of the end user seriously! However, I am a bit confused as to who would want this product. The sort of questions this product answers seem quite limited: 1. What URLs are getting lots of hits? 2. What referrers are generating lots of hits? 3. What screen sizes are those hits coming from? What decisions can be drawn from those questions? This seems useful only to perhaps some blog, where they're wondering what sort of content is successful, where to advertise more, and whether to bother making a mobile website. Without the ability to track user sessions -- even purely in localStorage -- you can't correlate pageview events. For instance, how would I answer a question like: - How many high-interest users do I have? By "high interest", I mean someone who visited at least three pages on my website. - Is a mobile website really worthwhile? How much of an effect does being on mobile have on whether someone will be "high-interest"? I should think some anonymized user ID system -- even if it rotates anonymous IDs -- should be able to answer these questions without compromising privacy. Also, I'll leave it to others to point out it's unlikely this product is exempt from GDPR.
- boernard 8y ago
  Since the creator points out that he doesn't store any IP addresses, he doesn't store any data that allows identifying an individual. For the GDPR to be applicable you need to store data that allows you to identify an individual. Thus when you use this, you don't have to think about GDPR.
  - ucarion 8y ago
    I'm not so sure. By putting this service's code on your website, you transmit personal data (IP addresses) to this third party. That appears to make the GDPR applicable here? Transmission is considered "data processing" under the GDPR. Really, the central point that should be clear is that this is a question for lawyers. The GDPR is incredibly far-reaching.
    - Aeolun 8y ago
      I mean, sure GDRP applies, but little of it’s provisions apply to storing no PII at all. If it means your website has to show a message ‘We transmit your info, but save nothing.’ It becomes a bit weird.
ckluis 8y ago
If you could track pageload time and show a distribution of that per page time - I would buy this in a second.
wumms 8y ago
"NoScript detected a potential Cross-Site Scripting attack from https://simpleanalytics.io https://simpleanalytics.io to https://js.stripe.com." https://js.stripe.com."
- javver 8y ago
  It appears to be the analytics of the stripe form, ironically.
harianus 8y ago
Because of the feedback I changed the pricing to $9!
yuhong 8y ago
I mentioned Google Analytics in my essay/overview.
deleted 8y ago
[deleted]
pauljarvis 8y ago
Fathom thought about data and privacy policy too: https://usefathom.com/data/ https://usefathom.com/data/
kposehn 8y ago
Thanks for making something simple and elegant. Main question: How are you handling Safari Intelligent Tracking Protection 2.0?
iDemonix 8y ago
Nice product! Could I ask what tech you're using for the graph data? I'm working on a similar SaaS (not analytics) which requires graphs. I'm a DevOps engineer for an ISP, and I do a lot of work with things like Graphite/Carbon, Prometheus and so on - but I can't seem to settle on what to use for personal projects. Do you use a TSDB at all? Or are you just storing it in SQL for now?
etatoby 8y ago
Good Sir, props to you for including a noscript/image tag in the default code. Google Analytics didn't do it for the longest time, and in fact may still not do it. Whether on purpose or by accident (or simply by mental bias) they seriously misrepresent the amount of people for whom JavaScript is blocked, not loading, disabled by default for unknown websites (me) or not available for any other reason. Website owners and creators should at least have that information as a reliable metric to base their development choices on.

e12e 8y ago

> The script is publicly available Nice. You might want to add an explicit copyright/license though. Make it less (or more) dangerous for other devs to read it... I think it could actually be quite useful to "standardize" on a simple (open/libre) front end for analytics (with an implied back-end standard).

cutety 8y ago

Just a heads up, HN comments only use a (I think) small subset of Markdown for formatting, but your link will work as is without having to wrap it in [] and adding the (). https://github.com/simpleanalytics/cdn.simpleanalytics.io/blob/master/hello.js https://github.com/simpleanalytics/cdn.simpleanalytics.io/bl... https://simpleanalytics.io/what-we-collect https://simpleanalytics.io/what-we-collect Anyway, cool project! I've always felt the same about using GA given I actually like to pretend I have some sort of privacy these days, and always have an adblocker on, so I hated setting it up for people. Definitely will be keeping an eye on this the next time someone asks me to setup GA.

harianus 8y ago
Thanks, I changed it. Glad you can relate!

blondin 8y ago

nice job! i like the direction you are taking with this project. it's still young, so we don't know X) you might get bitten too lol anyways, wish you the best luck with your endeavor. btw you might want to fix links above.

harianus 8y ago
Thank you! Fixed the links.

lucideer 8y ago

This look great—have bookmarked it for future projects. I would however a little more skeptical with tools claiming to be privacy-first than I would be with GA (who I presume are not privacy-first). On that note, some quick questions: - Any plans to open source? I've used Piwik/Matomo in the past, and while I'm not a massive fan of the code-quality of that project, it's at least auditable (and editable). - You say you're transparent about what you collect—IPs aren't mentioned on that page[0]. Are IPs stored in full or how are they handled? I assume you log IPs? - How do you discern unique page-views? You seem to be dogfooding and I see no cookies or localStorage keys set. [0] https://simpleanalytics.io/what-we-collect https://simpleanalytics.io/what-we-collect

harianus 8y ago
- No plans to go open source with the backend, but I do show the code that is run in the browser. The visualisation of the data is not super important I think. - I don't save IP's, not even in the logs. - I don't have unique pageviews at the moment. I will in the future. If the referrer is the same as the current page, I will measure that as a non-unique. What do you think?
- always_good 8y ago
  Doesn't seem like a very useful measure of uniqueness. What if you had one-day retention of IP addresses for per-day unique views? Seems like too important of a metric to eliminate completely, and one-day retention seems like a decent trade-off at the expense of being able to do unique analysis over longer time periods.
  - iampims 8y ago
    Don’t retain the IP address, retain a hash of the IP address.
    - detaro 8y ago
      A plain hash doesn't make a difference. One can use hashes with regularly changing salts that are destroyed after a while to make older hashes unusable though for some purposes.

consto 8y ago

This is pretty much exactly what I have been looking for. I recently ditched Google Analytics and all other possible third party resources (except for YouTube which I implemented a click to play system) on my blog (consto.uk). I just have a quick question. What subset of the javascript implementation does the tracking pixel provide? If all that is missing is screen size, I might just choose that to avoid running third party code. For performance, I combine, minify, and embed all scripts and styles into each page which lets me acheive perfect scores in the Chrome Auditor.

harianus 8y ago
I practice, you can copy the code to your server. You could subscribe to repo updates on https://github.com/simpleanalytics/cdn.simpleanalytics.io https://github.com/simpleanalytics/cdn.simpleanalytics.io and update your code if the changes make sense to you.

hashr8064 8y ago

Hey I like the idea but have a question. How are you storing all the information that analytics users want to know i.e. (What devices, what languages, what geolocations, what queries, what page navigations and clicks, etc.) After reading what you collect I'm assuming you are doing a lot of JS sniffing of browser properties to gather this information along with IP address analysis is that correct? Or what are you plans about these features if you don't have them now? Overall though I'd say great design + sales pitch. I think if the product delivers on enough features you will have something here. Great job!

sincerely 8y ago
It doesn't look like they collect or store languages, geolocations, or devices beyond screen sizes.
- Drdrdrq 8y ago
  And even if they did, if it is stored as aggregates, I (as a visitor) wouldn't mind.

nhooyr 8y ago

Why would sending requests as JSON require an extra request?

harianus 8y ago
Explained here: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS (search for preflight)

wnevets 8y ago

> like sending requests as JSON requires an extra (pre-flight) request, so in my script I use the "text/plain" content type, which does not require an extra request. what are the security implications of this?

cevn 8y ago
He's talking about skipping CORS by using a "plain" request. Avoiding CORS is not a huge security vulnerability afaik.

deleted 8y ago

[deleted]

deleted 8y ago

[deleted]

pdkl95 8y ago

> unnecessarily track users without their consent Regardless of your intentions, you are collecting enough data to track users. > I am transparent about what I collect ([URL]) That page doesn't mention that you are also collecting (and make no claim about storing) the globally-visible IP address (and any other data in the IP and TCP headers). This can be uniquely identifying; even when it isn't unique you usually only need a few bits of additional entropy to reconstruct[1] a unique tracking ID. In my case, you're collecting and storing more than enough additional entropy to make a decent fingerprint because [window.innerWidth, window.innerHeight] == [847, 836]. Even if I resized the window, you could follow those changes simply by watching analytics events from the same IP that are temporally nearby (you are collecting and storing timestamps). [1] An older comment where I discussed how this could be done (and why GA's supposed "anonymization" feature (aip=1) is a blatant lie): https://news.ycombinator.com/item?id=17170468 https://news.ycombinator.com/item?id=17170468

harianus 8y ago
Good comment! I only store the window.innerWidth metric. I updated the what we collect page (https://simpleanalytics.io/what-we-collect https://simpleanalytics.io/what-we-collect) to reflect the IP handling. We don't store them. And fingerprinting is something that would be definitely tracking, not on my watch!
- donut 8y ago
  You wrote "Point." - did you mean "Period."?
- samirm 8y ago
  There is absolutely no reason to collect and store window dimensions, other than for fingerprinting and tracking. Sure it might be an interesting piece of trivia for the dev, but it's not necessary for the dev to "make sure the website works great on all of those dimensions", since that much is already obvious and presumed when making websites these days.
  - soared 8y ago

dylz 8y ago

How can I run this myself? It absolutely isn't privacy-first if it requires running on someone else's machine and giving your users' data to them - another issue would be that while your server is in the EU, the hosting company is subject to US law, and all the stuff that comes with it (https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act f.e.)

shermozle 8y ago
Try Snowplow if you want to run it yourself.

ucarion 8y ago

First off: hats off for making a product that takes the rights of the end user seriously! However, I am a bit confused as to who would want this product. The sort of questions this product answers seem quite limited: 1. What URLs are getting lots of hits? 2. What referrers are generating lots of hits? 3. What screen sizes are those hits coming from? What decisions can be drawn from those questions? This seems useful only to perhaps some blog, where they're wondering what sort of content is successful, where to advertise more, and whether to bother making a mobile website. Without the ability to track user sessions -- even purely in localStorage -- you can't correlate pageview events. For instance, how would I answer a question like: - How many high-interest users do I have? By "high interest", I mean someone who visited at least three pages on my website. - Is a mobile website really worthwhile? How much of an effect does being on mobile have on whether someone will be "high-interest"? I should think some anonymized user ID system -- even if it rotates anonymous IDs -- should be able to answer these questions without compromising privacy. Also, I'll leave it to others to point out it's unlikely this product is exempt from GDPR.

boernard 8y ago
Since the creator points out that he doesn't store any IP addresses, he doesn't store any data that allows identifying an individual. For the GDPR to be applicable you need to store data that allows you to identify an individual. Thus when you use this, you don't have to think about GDPR.
- ucarion 8y ago
  I'm not so sure. By putting this service's code on your website, you transmit personal data (IP addresses) to this third party. That appears to make the GDPR applicable here? Transmission is considered "data processing" under the GDPR. Really, the central point that should be clear is that this is a question for lawyers. The GDPR is incredibly far-reaching.
  - Aeolun 8y ago
    I mean, sure GDRP applies, but little of it’s provisions apply to storing no PII at all. If it means your website has to show a message ‘We transmit your info, but save nothing.’ It becomes a bit weird.

ckluis 8y ago

If you could track pageload time and show a distribution of that per page time - I would buy this in a second.

wumms 8y ago

"NoScript detected a potential Cross-Site Scripting attack from https://simpleanalytics.io https://simpleanalytics.io to https://js.stripe.com." https://js.stripe.com."

javver 8y ago
It appears to be the analytics of the stripe form, ironically.

harianus 8y ago

Because of the feedback I changed the pricing to $9!

yuhong 8y ago

I mentioned Google Analytics in my essay/overview.

deleted 8y ago

[deleted]

pauljarvis 8y ago

Fathom thought about data and privacy policy too: https://usefathom.com/data/ https://usefathom.com/data/

kposehn 8y ago

Thanks for making something simple and elegant. Main question: How are you handling Safari Intelligent Tracking Protection 2.0?

iDemonix 8y ago

Nice product! Could I ask what tech you're using for the graph data? I'm working on a similar SaaS (not analytics) which requires graphs. I'm a DevOps engineer for an ISP, and I do a lot of work with things like Graphite/Carbon, Prometheus and so on - but I can't seem to settle on what to use for personal projects. Do you use a TSDB at all? Or are you just storing it in SQL for now?

etatoby 8y ago

Good Sir, props to you for including a noscript/image tag in the default code. Google Analytics didn't do it for the longest time, and in fact may still not do it. Whether on purpose or by accident (or simply by mental bias) they seriously misrepresent the amount of people for whom JavaScript is blocked, not loading, disabled by default for unknown websites (me) or not available for any other reason. Website owners and creators should at least have that information as a reliable metric to base their development choices on.