Introduction

MetrikStack is privacy-first web analytics in the spirit of Simple Analytics or Plausible, with one core differentiator: it can collect data from multiple sources and merge them into a single, truthful dataset.

The multi-source idea

Most analytics tools rely on a single browser script. That script misses whatever a browser doesn't run: visitors with ad blockers or tracking protection, bots, and increasingly, AI crawlers and AI assistants that fetch pages on a user's behalf. MetrikStack instead accepts events from several kinds of source for the same site:

• Browser script: the classic client-side tag.
• Server SDKs: middleware for Node (Express, Hono, Next.js) and Laravel that record a pageview when your own server renders the page.
• Edge integrations: a Cloudflare Worker that observes every response passing through your zone, including cache hits the origin never sees.
• Access logs: Vector or Fluent Bit shipping your existing nginx, Caddy, Traefik or Bunny logs, for zero-code coverage.

Because these sources can see overlapping traffic, MetrikStack needs a way to count a single page load once no matter how many sources observed it. See How merging works for the mechanism (request ids, primary source selection, enrichment rows and a fallback dedupe window).

Each source is entirely optional. A site can run just the script, just a server SDK, or any combination. The common single-source case involves no merge logic at all.

Privacy model

MetrikStack is built to collect as little as possible while still producing useful, aggregate analytics:

• No cookies, no local storage, no persistent device identifiers. The tracker script never writes to localStorage, sessionStorage or cookies.
• Visitors are identified by a daily-rotating salted hash of IP address and user agent, not by any stable id. The salt rotates every day at 00:00 UTC and is kept for two extra days to cover late-arriving events, then deleted. After that, hashes computed with it cannot be linked to any hash computed on another day.
• Raw IP addresses are never stored. An IP is used only to resolve a country/region and to compute the visitor hash, then discarded within milliseconds. Full user agents are never stored either.
• Global Privacy Control (GPC) is recorded, not used to drop events. Because no personal data is retained, there's nothing to opt out of by dropping the event. Instead the navigator.globalPrivacyControl flag is recorded on the event so aggregate reporting can reflect how many visitors sent it.
• Bots are stored, not silently dropped. They're classified and filtered out of default dashboard views instead, so you can still audit crawler traffic. See Bots & AI crawlers.

EU hosting

MetrikStack is hosted in the Netherlands. Visitor data is processed and stored in the EU and does not leave it as part of the standard pipeline.

Where to go next

• Quickstart: add the script tag and see your first event.
• Sources: every source in detail: script, Node SDK, Laravel, Cloudflare, Bunny, access logs.
• API: the public query API, authentication and realtime stream.