Case study
Self-hosted analytics with no cookies and no third-party services
maxa-analytics is the tool I wrote to track traffic on my own sites, maxadev.fr included. It stands here as a demonstration: the name is mine, the mechanics transfer.
0
cookies set on your visitors’ devices
The starting problem
I had several sites to keep an eye on (maxadev.fr, maxa-movies, maxence-os) and three places to do it from. maxadev.fr’s analytics sat with Google, behind a cookie banner, and so missed every visitor who declined cookies. The server logs sat in a terminal. As for outages, I was liable to hear about them from someone else first.
Each of them saw only part of the story. When the site stops responding, the page does not load and the visit is not counted: the chart dips without saying why. And most bots, which do not run the tracking script, are missing from the analytics even as they fill up the logs. Cross-referencing the two by hand is the kind of chore that keeps getting put off.
What was built
A single tool, installed on my server. On each site, a script under 3 KB gzipped, or a Next.js, Nuxt or Node connector, Electron apps included. The dashboard shows pages, sources (down to visits referred by ChatGPT or Claude), clicks, user journeys, funnels and real-time activity. All of it with no cookies and no persistent identifier.
Alongside it, a small agent ships the logs from Nginx Proxy Manager, the reverse proxy that sits in front of the sites. From those logs, the dashboard picks up what the script misses: bots, errors, scanners hunting for a .env file or a WordPress install, with a dedicated page for each IP address. Alerts tuned with a slider land on my iPhone and open the incident page directly.
The demonstration
The technical choices, and why
Three structural decisions, made to keep the tool lightweight, respectful of your visitors, and on your own infrastructure.
One container, one SQLite database
The dashboard and data collection fit in a single container, with a SQLite database. No CDN, no tracking pixel: no third-party service sits between your visitors and your analytics, the data stays on your server, and you do not depend on a vendor to keep accessing it.
Cookieless by design
Nothing is stored in the browser. Visitors are counted using an identifier hashed with a salt that rotates daily and is destroyed after two days. The IP address is never written to page views or events: only the session keeps the one it started with, for diagnostics, 30 days by default, then erases it, and a setting lets you turn IP storage off entirely.
MCP server secured with OAuth 2.1
The MCP server is built into the tool: Claude, or any other MCP client, queries your sites’ analytics and your reverse proxy logs in conversation, with no export to run and no public API to expose. The video shows three of these conversations, among them "Where am I losing buyers?" and "Give me this week’s recap".
What it changes in practice
When a chart dips, the site’s server view sets the proxy’s responses, errors included, against the page views: you can tell whether the audience is falling away or the site has stopped responding. And, if alerts are switched on, a run of server errors triggers a notification on my iPhone, with the evidence attached, before a visitor has to report the problem.
maxadev.fr itself is measured by this tool, and by this tool alone, with its visitors’ consent: no cookies, no Google Analytics, no big data aggregator. The MaxaDev figures shown in the video, however, are fictional, like the rest of the demonstration.
The same mechanics, for your case
The name is mine, the mechanics are not. Keep in-house the data you would usually hand to a third party, cross-check it against the logs that already exist, get an alert when a threshold is crossed, and query it all in conversation: that works for website traffic and for plenty of other things.
What I deliver is the tool shaped for your case, the hosting, and the source code. If your analytics depend on a cookie banner, or you hear about your outages from your customers, that is probably where to start.
- Cookieless analytics for your clients’ websites
- Usage tracking for a web or desktop application
- Server monitoring with mobile alerts
- Business metrics queried in plain language
Frequently asked questions
- No. It is the tool I use for my own sites, shown here to demonstrate what is achievable. What I deliver is a tool built for your use case, with its hosting and its source code.
- It covers the everyday use cases: pages, sources and UTM campaigns, events, journeys, funnels and real-time data. The difference lies in what the tool does not do: no cookies, no advertising use, no visitor data passed to a third party for measurement. And the server view adds what a conventional analytics tool cannot see.
- The tool is designed to work without cookies or persistent identifiers, and collection never passes through a third-party service. France’s data protection authority, the CNIL, allows some audience measurement to be exempt from consent, but that depends on the configuration (IP address retention, cross-referencing with server logs, the content of the events sent) and on how it is used. That decision rests with the site owner; I document precisely what is stored, and for how long.
- The script only sees the browsers that run it. The reverse proxy sees all the traffic that passes through it, including bots, scanners and 5xx errors when the application stops responding. These logs already exist: an agent ships them from Nginx Proxy Manager. The detailed logs, IP addresses included, are kept for 14 days by default; after that, only hourly totals remain, with no IP addresses.
- MCP is the protocol that lets an assistant such as Claude query an application. Here, the MCP server is built into the tool and secured with OAuth 2.1: you ask in conversation why your sales dropped or where you are losing buyers, or request a recap of the week, and the assistant fetches the answer from your analytics and your logs. Anything the assistant looks up is sent to the model behind it, so for sensitive data a model running on your own machine is the safer choice.