No cookies
The tracker sets no cookies. Visitors are counted with a hash that uses a random daily salt.
Privacy and security, stated plainly.
What the code does today, what we leave to you, and where to read it. The core is Apache-2.0, so each claim here can be checked.
Visitor privacy
No raw IP addresses
Visitor IPs are never stored. The salt is deleted after about 48 hours, so yesterday's hash cannot be rebuilt.
Do Not Track and GPC
DNT and Global Privacy Control are respected by default. Sites can add a consent step, and visitors can opt out with supermetry.optOut().
Anonymous mode
Set SUPERMETRY_TRACKING_MODE=anonymous for the strictest setup: no profiles, no custom properties, query strings and fragments stripped.
Accounts and access
Passwords and tokens
Passwords use Argon2id. Sessions, API keys, share links, invites and resets are stored as SHA-256 hashes, so a database dump alone is not a login.
Two-factor sign-in
TOTP with single-use recovery codes. Login is rate limited per IP and per account.
Invite-only by default
New self-hosted installs require an invitation to sign up. Open signup is an explicit setting.
Audit log
Owners and admins can review security-sensitive changes with date, action and target.
Browser protections
Strict CSP, frame-ancestors none, HttpOnly SameSite session cookies and CSRF tokens on state-changing calls.
Scoped API keys
Keys can be limited to sites and actions, can expire, and can be revoked at once.
Where your data lives
- Self-hosted. One Go binary and PostgreSQL on your own server. Nothing leaves it unless you configure webhooks or alerts.
- Cloud. EU hosting only. Every plan has every feature. Cloud is not open yet; ask for early access.
- Outbound calls. Webhooks, alerts and site icons cannot reach private, loopback or cloud-metadata addresses unless you allow it.
Auditable
- Apache-2.0. Read, build and run exactly what we ship.
- Threat model. A written analysis with code references lives in the repository, including the gaps.
- Private reporting. Use GitHub's private vulnerability reporting on the repository. Please do not open a public issue.
What it does not protect
These come from the project's own security policy. Knowing them helps you plan around them.
- Event ingest is unauthenticated. The site ID is public, so someone can send fake events. Allowed hosts, rate limits, bot and referrer lists, exclusions and the optional strict origin check raise the cost but cannot stop it.
- Rate limits are per process. Several instances multiply them; use your reverse proxy for a shared limit.
- The secret key cannot be rotated yet. If it leaks, treat the sealed secrets as exposed.
- Backups are not encrypted. Store them encrypted.
- Not personal-data-free by promise. Hostnames, event names and replay content can hold identity if your application puts it there.
- Pre-release. A full security review is still on the list, and only the latest commit is supported until v0.1.0.
Check it yourself.
The source, the threat model and a live demo are all open.