Skip to content

CookielessOpen sourceSees AI traffic

Web analytics.
Private by design.
Open by default.

Count visitors without cookies, fingerprints, or stored IPs. A 1 KB script, a server you can read, and a public manifest of what is kept.

Request early access Live demo GitHub

AGPL server · MIT tracker · docker compose up

Drop-in for

  • Next.js
  • Express
  • Hono
  • Cloudflare Workers
  • Node http
  • Ollama
  • MCP
  • Docker Compose
  • Postgres
  • Supabase Auth

The product, as pages

Not one long scroll.

Each claim has a URL. Use the menu, or start here.

How it works

Script, middleware, dashboard.

A 1 KB tracker for people, a server middleware for everything that never runs JavaScript, and an MCP server for your agents.

Read

AI traffic

Name every actor.

Humans, humans via ChatGPT, GPTBot fetches, headless agents. Direct stops being a junk drawer.

Read

Open source

AGPL server. MIT edges.

Read the ingest path. Embed the tracker and middleware without the licence following you out.

Read

Privacy

A manifest, not a promise.

No cookies, no fingerprints, no stored IPs. The collection contract is a public JSON document per site.

Read

A dark server corridor with amber status lights receding into shadow

Journal

GPTBot never runs your analytics script

Training and search crawlers fetch HTML and leave. If your only collector is a browser snippet, those fetches never existed — and most privacy-first tools still miss them.

6 Sept 2026 · 23 essays

Privacy by design

Not a promise. A manifest.

No cookies, no fingerprints, no stored IP addresses — and you do not have to take our word for it. Every site publishes a machine-readable statement of what is stored, how visitors are counted, and which questions the system cannot answer. Your users, your auditors, and your own agents can fetch it at /api/sites/{domain}/manifest.

Stored

  • Page pathtraffic reports
  • Referrer hostattribution — host only
  • UTM parameterscampaigns
  • Country / regionIP discarded after lookup
  • Device · browser · OSdevice reports
  • Event name + propsgoals
  • Actor + AI sourceAI traffic
  • Visitor hashunique for one UTC day

Never stored

  • IP address
  • Cookies
  • localStorage identifiers
  • Fingerprints
  • Cross-site identity

Cannot answer

  • Who a visitor is
  • Whether they came back after midnight UTC
  • Cross-site or cross-device identity
  • Exact address (city is off by default)
  • Anything about visitors who block the request
Collection manifest · public
GET /api/sites/example.com/manifest

{
  "name": "Vector 5 Analytics",
  "site": "example.com",
  "cookies": false,
  "local_storage": false,
  "fingerprinting": false,
  "ip_stored": false,
  "visitor_hash": "sha256(daily_salt || site_id || ip || user_agent); salt rotates 00:00 UTC",
  "retention_days": 730,
  "fields": ["path", "referrer_host", "utm", "country", "device",
             "browser", "os", "actor", "ai_source", "event_name"],
  "cannot_know": [
    "Who a visitor is",
    "Whether they returned after midnight UTC",
    "Cross-site or cross-device identity",
    "Exact address or city",
    "Anything about visitors who block the request"
  ]
}

How a visitor is counted

visitor_hash = SHA-256(daily_salt ‖ site_id ‖ ip ‖ user_agent)

The salt rotates at 00:00 UTC per site. After hashing, the IP is dropped. A visitor who returns tomorrow is counted as new — on purpose. There is nothing to subpoena, leak, or sell.

Read the full privacy model

Compare

Honest differences.

Vector 5 is a clean-room product, not a fork. Here is where it is the same as the tools you know, and where it is not.

Full comparison
Vector 5Plausible-classUmami / Rybbit-classGoogle Analytics
Actor on every eventYesNoNoNo
AI crawler reports (GPTBot, ClaudeBot, PerplexityBot…)YesNoNoNo
Server-side middleware for non-JS visitorsYesNoRareServer-side GTM
Public collection manifest per siteYesNoNoNo
AI insights from aggregates onlyYesNoChat on raw dataYes, Google-hosted

FAQ

Questions people actually ask.

Do I need a cookie banner?
Vector 5 sets no cookies and writes no identifiers to localStorage, so it does not trigger the consent requirements that cookie-based analytics do. Unique visitors are counted with a salted hash that rotates daily and cannot be reversed. As always, confirm with your own counsel for your jurisdiction — and hand them the manifest.
How can you count unique visitors without cookies?
Each hit is hashed as SHA-256(daily_salt ‖ site_id ‖ ip ‖ user_agent). The salt rotates at 00:00 UTC per site and the IP is dropped immediately after hashing. That gives accurate daily uniques and makes cross-day tracking impossible by design.
How do you see AI crawlers if they never run JavaScript?
Through the server middleware. It runs inside your application (Next.js, Express, Hono, Cloudflare Workers, or plain Node), inspects the user agent, and forwards non-human requests to your Vector 5 instance. Crawlers are recorded with the exact page they fetched.
What exactly is human_via_ai?
A person who arrived from an AI assistant. Vector 5 recognises referrers from chatgpt.com, perplexity.ai, claude.ai, gemini.google.com, copilot.microsoft.com, grok.com and chat.deepseek.com, plus utm_medium=ai_search / ai-assistant and utm_source values like chatgpt or perplexity. Assistants often strip referrers, so the true number is likely higher — Vector 5 never guesses to fill the gap.
Does the AI insights feature send my data to a third party?
Only aggregates — counts, ratios, week-over-week deltas — are ever passed to a model, and only if you turn insights on. Point it at Ollama and nothing leaves your server. OpenAI, Anthropic, Gemini and any OpenAI-compatible endpoint are also supported.
Is Vector 5 a Plausible fork?
No. It is a clean-room implementation in Go and TypeScript. It is not affiliated with Plausible Analytics and uses none of their code or assets. The comparison page names them only to be honest about where the products overlap.
What does it cost to self-host?
Nothing. The server and dashboard are AGPL-3.0; the tracker, middleware, MCP server and skills are MIT. Run docker compose up, point your DNS at it, and add the script. Hosted Vector 5 is invite-only early access — request a seat on the access page if you would rather not operate Postgres yourself.
Can I migrate my existing data?
Yes. Import historical aggregates from CSV, and export everything as JSON at any time. There is no lock-in and the schema lives in the repository.

Early access

Signup is closed. Request a seat.

Vector 5 is in private early access. Leave your email — we invite people in small batches. No account is created until then.

Self-host from GitHub

Invite only · No public signup · No credit card