Introduction

MetrikStack is privacy-first web analytics in the spirit of Plausible or Simple Analytics. Unlike those tools, it can collect data for one site from several sources and merge them, so a page load seen by the script and by your server is counted once.

Why more than one source

Most analytics tools rely on a single browser script. That script misses every visit where it doesn't run: visitors with ad blockers or tracking protection, bots, and the AI crawlers and assistants that fetch pages without running JavaScript. MetrikStack also accepts events from:

• Browser script: the usual client-side tag.
• Server SDKs (not published yet): Node (Express, Hono, Next.js), Laravel and WordPress record a pageview when your own server renders the page.
• Edge and CDN logs: a Cloudflare Worker that sees every response through your zone, including cache hits your origin never sees, and bunny.net Log Forwarding.
• Log drains and access logs: Vercel and Netlify log drains, or nginx, Caddy and Traefik logs shipped with Vector or Fluent Bit. These need no code changes.

Sources often see the same page load, so MetrikStack matches them up and counts it once. How merging works explains the mechanism (request ids, primary source selection, enrichment rows and a fallback dedupe window).

Every source is optional. A site can run only the script, only a server SDK, or any combination. A site with a single source never goes through the merge logic at all.

Who visited

Every request is sorted into one of five groups: people, AI assistants (a fetch made because someone asked ChatGPT, Claude or Perplexity something just now), AI crawlers (training and AI search indexing), search engines, and other bots. When a request claims to be GPTBot or Googlebot, MetrikStack checks its address against the network the operator publishes, and an impostor counts as other bots. See AI crawlers and bots.

Bots are stored and labelled rather than dropped. In the dashboard, Overview shows all traffic split into these groups, People shows people only, and AI visibility covers AI assistants and crawlers.

Privacy model

MetrikStack collects as little as it can while still producing useful aggregate numbers:

• No cookies, local storage or persistent device identifiers. The tracker script never writes to localStorage, sessionStorage or cookies.
• Visitors are identified by a salted hash that changes every day. It is made from the IP address and user agent, with a salt that rotates at 00:00 UTC. Each salt is kept for two more days to cover late events, then deleted. After that, hashes from that day can't be linked to hashes from any other day.
• Raw IP addresses are never stored. An IP is used to look up country, region and city and to compute the visitor hash, then discarded within milliseconds. Full user agents are not stored either.
• Global Privacy Control (GPC) is recorded on the event. A visit that sends navigator.globalPrivacyControl is still counted, because nothing personal is kept that the visitor could opt out of. The flag is stored so you can see how many visitors sent it.

Pricing and volume

There is one plan, priced by monthly pageviews, with a 14-day trial. Every tier includes every source and feature. Only pageviews and custom events by people count toward your volume, so bots, AI crawlers and a second source seeing the same pageview cost nothing extra. See Plans, limits and usage.

EU hosting

MetrikStack is hosted in the Netherlands. Visitor data is processed and stored in the EU and does not leave it as part of the standard pipeline.

Where to go next

• Quickstart: add the script tag and see your first event.
• Sources: each source in detail, from the script and server SDKs to Cloudflare, Bunny and access logs.
• API: the query API, authentication and the realtime stream.