Open-source web analytics · MIT licence

Analytics that keeps every wave.

Tidesight is self-hosted web analytics for any number of websites. Every hit is stored raw on your own server, then turned into a dashboard as complete as the big tools: reports and comparisons, heatmaps, session replays, Web Vitals, errors, funnels and more. It runs on the cheapest shared hosting, with Python, SQLite and cron.

Try the live demo Get started

The demo is Tidesight itself, running in your browser on made-up data. No sign-up, nothing sent anywhere.

The Tidesight dashboard: overview of a surf shop's last 30 days, with visitors, visits, pageviews, bounce rate and visit duration against the previous period, a daily traffic chart, channels and top pages

Why Tidesight

01

Raw first

Every hit is kept as it arrived, headers and payload included. Sessions, places, devices, channels and identities come from jobs you can run again: improve a rule, and the past follows.

02

Complete

Comparisons, filters, segments, goals, funnels, retention, heatmaps, recordings, Web Vitals, errors, forms, site search and visitor timelines, in one dashboard and for every site.

03

Yours, on cheap hosting

A standard-library Python app and SQLite files, on the host you already pay for. No daemon, no database server, no monthly bill, and no data leaving your server.

Features

Everything the big tools show you. Nothing they keep.

Realtime

Who is on your sites right now, the pages they read and where they came from.

Reports and comparisons

Any period against the previous one or a year before, changes everywhere, filters on every dimension, saved segments, annotations.

Acquisition

Channels as in GA4, AI assistants included; sources, campaigns, referrers and click ids.

Heatmaps

Clicks, rage and dead clicks, mouse movement and scroll reach, drawn on the page as it looked.

Session replay

Watch visits again with rrweb. Inputs are masked and passwords never recorded.

Web Vitals and errors

LCP, INP and CLS by page and over time; JavaScript and resource errors, grouped.

Funnels and retention

Ordered steps within a visit, and the share of visitors who come back, week after week.

Explorer and exports

Any dimension, a second one, every matching row to Excel, CSV, TSV or JSON. A JSON API for scripts.

Visitors and visits

A timeline for every visit, a profile for every visitor, identities stitched across devices.

Any number of sites

Add a property in the dashboard, paste one line into its pages, see the first visit arrive.

Goals

Pages or events as goals, with conversions and conversion rates in every report.

Privacy mode

IP truncation or hashing, retention windows, Do Not Track and GPC, no fingerprinting: a setting and a clean-up job.

Tour

See it before you install it.

Realtime: eleven visitors in the last five minutes, pageviews per minute, active pages and referrers
Visitors in the last five minutes, pageviews minute by minute, the pages they read and where they came from.

Open the live demo

How it works

Raw in, insight out, nothing in between.

  1. Trackerts.js, about 8 KB. Pageviews, events, single-page apps; plugins load only where they are switched on.
  2. CollectorPython's standard library. Appends every hit, raw, to SQLite, answers in milliseconds, and never enriches.
  3. JobsCron derives sessions, places, devices, bots, channels and identities, then daily rollups. Re-runnable and versioned.
  4. DashboardA static app on a small JSON API, for the dashboard and your scripts alike.

The derived database can be deleted at any time: it is rebuilt from the raw hits.

Runs where your website runs

Shared hosting with Python (FastCGI or CGI) and cron is enough: everything lives in one folder, the website's, behind an .htaccess, and Tidesight checks from the outside that none of its files can be downloaded. A host without Python web apps can collect with the PHP connector; Node and Cloudflare Workers connectors speak the same protocol, checked by a shared conformance suite.

Updates in one click

Tidesight looks for new releases once a day. An admin clicks Update; the next cron run downloads it, checks it, puts it in place and keeps the previous version for a rollback. The tracking code on your sites never changes: it is served by Tidesight, so it follows.

Get started

From zero to your first visitor, in five steps.

  1. Try it on your computer

    Python 3.9 or later, nothing else. The demo makes 60 days of visits to three made-up websites, through the real collector and jobs.

    Terminal
    git clone https://github.com/mayerwin/Tidesight.git
cd Tidesight
python tools/demo.py --out demo-data
python server/python/devserver.py --no-auth --port 8790 \
  --config demo-data/tidesight.toml

    Then open http://127.0.0.1:8790/dashboard/.

    The three demo properties in the dashboard: a surf shop, a magazine and a web app

  2. Put it on your host

    Unpack the latest release in your website's folder, copy two files next to it, write tidesight.toml and add one cron line. The guide walks through it, for Dreamhost and similar hosts.

    Terminal, on the server
    cd ~/stats.example.com    # your website's folder
curl -L https://github.com/mayerwin/Tidesight/releases/latest/download/tidesight.tar.gz | tar xz
cp app/server/python/tidesight.fcgi . && chmod 755 tidesight.fcgi
cp app/server/python/web.htaccess .htaccess
cp app/config/tidesight.example.toml tidesight.toml

    The step-by-step deployment guide →

  3. Create the first account

    The first time the dashboard opens, it asks for a setup code that only someone with access to the server can read, so a bot that finds a new installation first cannot claim it. Invite your team afterwards with one-time links.

    The first-account form: the setup code read on the server, a user name and a password

  4. Add your website

    Give its address and a time zone, choose what to record, and paste one line into the <head> of its pages. The dialog says when the first visit arrives.

    HTML, in the <head> of every page
    <script async src="https://stats.example.com/ts.js" data-site="example-com"></script>
    Adding a property: the tracking code to paste, and a box waiting for the first visit

  5. Watch the tide come in

    Visitors appear on the Realtime page within seconds; reports fill in as the cron job runs, every couple of minutes. Custom events take one more line:

    JavaScript
    tidesight('track', 'signup', { plan: 'pro' });
    The Realtime page with visitors arriving

Privacy

Your visitors' data stays with you.

  • Stored on your server only; the tracker and the dashboard load nothing from any other host.
  • A privacy mode for strict settings: IP truncation or hashing, retention windows, Do Not Track and Global Privacy Control, no fingerprinting.
  • Tokens, passwords and session ids in URLs are redacted before they leave the browser. Form values are never collected.
  • Every data point has a per-site switch, every behaviour plugin a sampling rate.

Security

Built for a public endpoint.

  • Body sizes, request rates and daily quotas are bounded; junk traffic gets its own small allowance.
  • Credentials and other sites' cookies are never stored; passwords travel over HTTPS only.
  • A strict Content Security Policy keeps recordings from contacting other hosts.
  • The collectors, the tracker and the dashboard went through adversarial security reviews; every finding was fixed and covered by tests.

Questions

Good to know

What does it cost?

Nothing: Tidesight is MIT-licensed. You need a host with Python 3.9 or later (FastCGI or CGI) and cron, which most shared hosting plans include, or PHP, Node or Cloudflare Workers for the collector.

How much traffic can it take?

In the hosting test on a shared Dreamhost server, SQLite with write-ahead logging took about 1,800 inserts a second from eight processes at once, with no errors: far more than most websites send. The tracker batches events, and every limit is configurable.

Do I need a cookie banner?

That depends on where you and your visitors are, and on what you switch on. Tidesight records a lot by default; its privacy mode and per-site switches let you match stricter rules. Check your own obligations.

How do updates work?

Once a day, Tidesight looks for a new GitHub release. An admin sees it in the dashboard and clicks Update; the next cron run installs it and keeps the previous version for a rollback. Database migrations run by themselves, and the sites' tracking code never needs to change.

Does the live demo send anything anywhere?

No. It is Tidesight's own dashboard and Python web app, compiled to WebAssembly with Pyodide and running in your browser on made-up data. It is rebuilt every few hours, so its dates are always recent.

Can I query the data myself?

Yes: the dashboard is built on a JSON API that scripts can use too, every report and raw dataset downloads as Excel, CSV, TSV or JSON, and the data are plain SQLite files.

Watch your traffic like the tide.

Open the demo, or star the repository to follow new releases.

Try the live demo Star on GitHub