Inspired by Umami — open-source web and product analytics.
Every small business site I’ve inherited has the same line in its <head>: a Google Analytics snippet someone pasted in 2019 and nobody has logged into since. It sits there slurping data into an account nobody checks, feeding a dashboard with forty reports, hanging a consent banner off the front of the site, and — the part that always gets me — costing actual page weight on every visit, on a service the site owner doesn’t control and can’t export anything useful out of.
Google Analytics is built for organisations with analysts. A tradie’s site, a consultancy, a hobby blog with delusions of grandeur: none of these need “explorations” or a predictive audience. They need four answers — is anyone here, where did they come from, what did they read, did that campaign work? — and they need them in ten seconds without a training course.
That’s the whole case for Umami, an MIT-licensed, privacy-first analytics platform you can self-host. No cookies, no personal data, no cross-site tracking — first-party aggregation only. It answers the four questions and declines to collect the surveillance surplus that creates the legal and ethical overhead in the first place.
Why “no cookies” is a bigger deal than it sounds
It’s not a values statement, it’s an operational one. Analytics that sets no cookies and stores no personal data doesn’t just feel cleaner — it removes the reason a small site drags a consent banner in front of every visitor. I’m not your lawyer and rules differ by jurisdiction, so verify your own obligations, but the banner exists to obtain consent for the tracking. Delete the tracking and the banner’s reason for existing goes with it. Fewer scripts, faster loads, nothing to consent to.
There’s a trust angle too: when a client asks “who has my visitors’ data?”, the answer becomes “me, in a Postgres database on hardware I control, and it’s page URLs and referrers, not people.” That’s an answer you can give without flinching.
One container and a database
The deployment is the kind of small a homelab barely notices. Umami ships a Docker image and a compose file that brings up the app with PostgreSQL:
docker compose up -dThe image is docker.umami.is/umami-software/umami:latest, the database wants PostgreSQL 12.14 or newer, and the first build creates your tables plus an admin account you should change the password of immediately. If you’d rather run from source, it’s a Node 18.18+ app with a one-variable .env — DATABASE_URL — and a build step. Behind your existing reverse proxy on some hostname like stats.example.com, it’s just another service in the rack. Updates are the usual dance: docker compose pull && docker compose up -d --force-recreate.
Instrumenting the site is one async script tag with a data-website-id. There’s no plugin to install, no tag manager to wrangle. If you can edit a template, you’re live.
What you get, and what you don’t
The dashboard is deliberately small: traffic over time, visitors, pageviews, top pages, referrers, countries, browsers and devices, plus events and UTM-tagged campaigns so “did the newsletter work” is a filter click instead of a research project. You can generate share links — a public, read-only view of a site’s stats — which is a surprisingly useful client-facing feature: send the link, skip the PDF export ritual every month.
What you don’t get is the deep end: session replay, funnels through twelve steps, cohorts, “AI insights”. If your business genuinely lives and dies on product-analytics funnels, run a product-analytics tool and pay for it honestly. But for the ninety percent of sites whose analytics questions end at “is the blog working, and where do people come from”, the deep end is a cost centre — in dollars, in complexity, and in privacy exposure.
One genuinely forward-looking detail: Umami has an MCP endpoint (off by default — enable with MCP_ENABLED=1 and an API key from Settings). That means your agent can query the analytics itself. “Ask the stats server how last week’s post did” becomes a tool call. On a homelab that’s already agent-shaped, that’s a nice little moat GA will never give you.
The honest trade-offs
- You own the uptime. If the container falls over, your stats stop recording. It’s a single service with one dependency — but it’s yours to monitor, back up and upgrade. Put it with the rest of your watched services.
- You own the data — including its loss. Back up the database. It’s one Postgres volume; snapshot it with everything else.
- Ad blockers still block it. Self-hosted analytics dodges most GA-specific blocklists but not all blockers. Treat numbers as trends, not censuses — which, honestly, is all GA ever gave you too.
Google Analytics is free the way a puppy is free: the purchase price is the smallest cost you’ll ever pay. For a small business site, Umami flips the model — a few hundred megabytes of RAM and a Postgres volume, in exchange for faster pages, no consent banner theatre, answers in ten seconds, and a stats database whose continued existence doesn’t depend on a product manager at a trillion-dollar company staying interested. That last one, historically, is the strongest argument of all.