Repository snapshot: 5b3a97e. Hosting eligibility reflects the deployment documentation and listed assumptions.

• plausible ↗

  **Self-hosted, privacy-friendly web analytics built entirely on Cloudflare.**

• google-analytics ↗

  **Self-hosted, privacy-friendly web analytics built entirely on Cloudflare.**

• fathom ↗

  **Self-hosted, privacy-friendly web analytics built entirely on Cloudflare.**

• workers ↗

  name = "traks-api-dev" main = "src/index.ts" compatibility_date = "2026-06-01" compatibility_flags = ["nodejs_compat"] # Dashboard requests are back-end bound: each one makes several sequential hops # to D1, the live Durable Object and R2 SQL, none of which live at the edge. # Running near the data beats running near the viewer here - the opposite of # the collect worker, which stays at the edge because ingest latency is felt on # the visitor's page. [placement] mode = "smart" # --- Dev (local-first: wrangler dev, shared state in <root>/.wrangler-state) --- # Local dev serves the SPA from vite (:5012, proxying /ap

• r2 ↗

  ▼ zero ingest delay, ms queries Iceberg sink → R2 Data Catalog serves: today, realtime table `traks.events` ▲ (zstd parquet, 60s roll, │ auto compaction + │ snapshot expiration) │ ▼ │ COLD PATH: R2 SQL ◄── api Worker (apps/platform/api) ── Better Auth, D1 metadata serves: 7d/30d/90d/1y/all ▲ today/realtime → DO (edge-cached 5-15 min) │ history → R2 SQL │ (DO failure → R2 SQL fallback) web dashboard (apps/platform/web) ``` ### How the pieces fit - **`apps/platform/collect`** — ingest Worker. Validates the site key against D1, filters bots, computes the daily-rotating visitor ID, enriches events with Cloudflare geo data, then **dual-writes**: to the Pipelines stream (durable system of record

• durable-objects ↗

  r "today"/realtime dashboards. [[migrations]] tag = "v1" new_sqlite_classes = ["SiteLiveStore"] [[durable_objects.bindings]] name = "LIVE" class_name = "SiteLiveStore" # Pipelines *stream* binding - events are sent to the stream, the pipeline # moves them into the Iceberg sink. (`stream` replaced the deprecated # `pipeline` key in June 2026.) [[pipelines]] binding = "EVENTS" stream = "f0ee6ab42aa7462094f374857e996b47" # traks_events_dev_stream (dev) [vars] ENVIRONMENT = "development" # The platform ships to customers as a release bundle; the ONLY install path # is the traks.dev deploy wizard. There is no wrangler prod deploy - our own # instance (and any staging one)

• d1 ↗

  events # warehouse (R2 SQL over traks-events-dev) is a real cloud dependency. [[d1_databases]] binding = "DB" database_name = "traks-db-dev" database_id = "cd0ff4bb-5cc4-4002-a259-be02b3234e29" migrations_dir = "src/db/migrations" # Cross-script binding to the collect worker's live-stats Durable Object # (hot path for "today"/realtime queries). The collect worker owns the class. [[durable_objects.bindings]] name = "LIVE" class_name = "SiteLiveStore" script_name = "traks-collect-dev" # Global (cross-colo) result cache for R2 SQL dashboard queries. Layered # behind the per-colo Cache API: a scan any colo already paid for is reused # worldwide for the TTL. On workers.dev

• kv ↗

  ult) the # Cache API is a no-op, so this KV namespace is the only result cache. [[kv_namespaces]] binding = "R2SQL_CACHE" id = "fc5eb93cfb8f4cb18969af2ccd4f9ea5" # Query telemetry: one row per R2 SQL cache decision (wall ms, rows, outcome). [[analytics_engine_datasets]] binding = "METRICS" dataset = "traks_api_metrics_dev" # Every minute: the pre-warm sweep (src/lib/prewarm.ts) - a no-op unless a # cache bucket just rolled for a recently viewed site. # Brute-force guard on the auth surface, keyed by client IP. Better Auth's # built-in limiter is in-memory - per-isolate on Workers, so effectively no # limiter at all. A single-owner instance has one known account, so this

• analytics-engine ↗

  # Query telemetry: one row per R2 SQL cache decision (wall ms, rows, outcome). [[analytics_engine_datasets]] binding = "METRICS" dataset = "traks_api_metrics_dev" # Every minute: the pre-warm sweep (src/lib/prewarm.ts) - a no-op unless a # cache bucket just rolled for a recently viewed site. # Brute-force guard on the auth surface, keyed by client IP. Better Auth's # built-in limiter is in-memory - per-isolate on Workers, so effectively no # limiter at all. A single-owner instance has one known account, so this is # the only thing standing between it and offline-speed guessing. [[ratelimits]] name = "AUTH_LIMIT" namespace_id = "1004" simple = { limit = 20, period = 60 }

• paid ↗

  # traks.dev home worker - deploy-wizard backend ONLY. Physically separate # from the platform api that ships to customer instances: different worker, # different secrets, and no database of its own. The marketing site + wizard # UI is the traks-site static-assets worker; this worker claims the dynamic # paths on traks.dev via zone routes (which beat custom domains). name = "traks-home-api-dev" main = "src/index.ts" compatibility_date = "2026-06-01" compatibility_flags = ["nodejs_compat"] # The only state: one Durable Object per wizard session (progress replay) and # per instance (run lock), each wiping itself 24 hours after its first write. # Nothing about anyone's instance is kept beyond that. [[migrations]] tag = "v1" new_sqlite_classes = ["DeploySession"] # --- Dev (wrangler dev, port

• paid ↗

  The Workers Paid plan includes Workers, Pages Functions, Workers KV, Hyperdrive, and Durable Objects usage for a minimum charge of $5 USD per month for an account. The plan includes increased initial usage allotments, with clear charges for usage that exceeds the base plan. There are no additional charges for data transfer (egress) or throughput (bandwidth).

• paid ↗

  | Storage | 10 GB-month / month |

• paid ↗

  Durable Objects are available both on Workers Free and Workers Paid plans.

• paid ↗

  | Rows read | 5 million / day | First 25 billion / month included + $0.001 / million rows |

• paid ↗

  | Keys read | 100,000 / day | 10 million/month, + $0.50/million |

• paid ↗

  | **Workers Paid** | 10 million included per month <br> (+$0.25 per additional million) | 1 million included per month (+$1.00 per additional million) |

• paid ↗

  Currently, you will not be billed for your use of Workers Analytics Engine. Pricing information here is shared in advance, so that you can estimate what your costs will be once Cloudflare starts billing for usage in the coming months.

• paid ↗

  | Class A Operations | 1 million requests / month |

• paid ↗

  | Class B Operations | 10 million requests / month |

• paid ↗

  | Rows written | 100,000 / day | First 50 million / month included + $1.00 / million rows |

• paid ↗

  | Keys written | 1,000 / day | 1 million/month, + $5.00/million |

• paid ↗

  | SQL Stored data ⁵ | 5 GB (total) | 5 GB-month, + $0.20/ GB-month |

• MIT ↗

  MIT License Copyright (c) 2026 Shivaprasad Manupadi Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR I

• architecture ↗

  s tracker (packages/tracker) │ POST /api/event ▼ collect Worker (apps/platform/collect) ── site-key auth + timezone (D1) │ bot filtering, UA/referrer parsing, │ dual write daily-rotating visitor hash (HMAC) ├────────────────────────────┐ ▼ env.EVENTS.send() ▼ env.LIVE (SiteLiveStore DO) Pipelines stream HOT PATH: per-site SQLite DO │ pass-through pipeline rolling ~48h event window ▼ zero ingest delay, ms queries Iceberg sink → R2 Data Catalog serves: today, realtime table `traks.events` ▲ (zstd parquet, 60s roll, │ auto compaction + │ snapshot expiration) │ ▼ │ COLD PATH: R2 SQL ◄── api Worker (apps/platform/api) ── Better Auth, D1 metadata serves: 7d/30d/90d/1y/all ▲ today/realtime → DO (edge-cached 5-15 min) │ history → R2 SQL │ (DO failure → R2 SQL fallback) web dashboard (apps/platform/web) ``` ### How the pieces fit - **`apps/platform/collect`** — ingest Worker. Validates the site key against D1, filters bots, computes the daily-rotating visitor ID, enriches events with Cloudflare geo data, then **dual-writes**: to the Pipelines stream (durable system of record) and to the site's **SiteLiveStore Durable Object** (hot path). Each write fails independently. - **`SiteLiveStore` DO** — one SQLite-backed instance per site holding a rolling ~48h event window (today plus the previous-day comparison window in any timezone). Today/realtime queries run against local SQLite with millisecond latency. It is also the **realtime push** source: the dashboard opens one authenticated WebSocket (WebSocket Hibernation API) and receives a frame — live visitors, their pages, referrers, countries, and city-level coordinates — whenever a pageview changes the picture, plus a 30s tick so counts decay as visitors leave. Coordinates exist only in this hot window and are never written to Iceberg. - **Pipeline** — pass-thr

• architecture ↗

  t runs end to end on Cloudflare's data platform — Workers, Durable Objects, D1, Pipelines, R2 Data Catalog (Apache Iceberg), and R2 SQL. No servers to manage, no third-party services in the data path, and no personal data stored. [](LICENSE)   Open source under the MIT license. Free to run, forever: the only cost is your own Cloudflare usage, which stays inside the free allowances for most sites. Install it at [traks.dev](https://traks.dev); read the release notes at [traks.dev/changelog](https://traks.dev/changelog). ## Highlights - **Privacy-first** — no cookies, no fingerprinting persistence. Visitors are counted with a Plausible-style daily-rotating hash (`HMAC(secret + date, ip + ua + siteKey)`); raw IP addresses are never stored. - **Realtime by default** — a hot/cold split serves "today" and live views from per-site SQLite Durable Objects in milliseconds, with zero ingest delay. A WebSocket pushes live visitors, pages, referrers, and city-level map dots to the dashboard as they happen. - **Cheap at any scale** — history lives in Apache Iceberg on R2 and is queried with R2 SQL, edge-cached, and scan-minimized. A side project runs for ~$5/mo, 5M pageviews/mo for ~$7, and past that about $4.60 per additional million events (see [cost model](#what-it-costs-to-run)). - **Fully self-contained** — auth is [Better Auth](https://better-auth.com) on D1 (no auth SaaS), the world map is self-hosted (no tile servers), and the dashboard never calls a third party. - **Agent-ready** — analytics are exposed to AI agents via MCP/WebMCP tools, with bot and agent traffic classified and reported alongside human traffic. - **Tiny t

• architecture ↗

  name = "traks-api-dev" main = "src/index.ts" compatibility_date = "2026-06-01" compatibility_flags = ["nodejs_compat"] # Dashboard requests are back-end bound: each one makes several sequential hops # to D1, the live Durable Object and R2 SQL, none of which live at the edge. # Running near the data beats running near the viewer here - the opposite of # the collect worker, which stays at the edge because ingest latency is felt on # the visitor's page. [placement] mode = "smart" # --- Dev (local-first: wrangler dev, shared state in <root>/.wrangler-state) --- # Local dev serves the SPA from vite (:5012, proxying /api to :5011). D1/KV # are local simulations; ids below are inert locally. Only the events # warehouse (R2 SQL over traks-events-dev) is a real cloud dependency. [[d1_databases]] binding = "DB" database_name = "traks-db-dev" database_id = "cd0ff4bb-5cc4-4002-a259-be02b3234e29" migrations_dir = "src/db/migrations" # Cross-script binding to the collect worker's live-stats Durable Object # (hot path for "today"/realtime queries). The collect worker owns the class. [[durable_objects.bindings]] name = "LIVE" class_name = "SiteLiveStore" script_name = "traks-collect-dev" # Global (cross-colo) result cache for R2 SQL dashboard queries. Layered # behind the per-colo Cache API: a scan any colo already paid for is reused # worldwide for the TTL. On workers.dev installs (the wizard default) the # Cache API is a no-op, so this KV namespace is the only result cache. [[kv_namespaces]] binding = "R2SQL_CACHE" id = "fc5eb93cfb8f4cb18969af2ccd4f9ea5" # Query telemetry: one row per R2 SQL cache decision (wall ms, rows, outcome). [[analytics_engine_datasets]] binding = "METRICS" dataset = "traks_api_metrics_dev" # Every minute: the pre-warm sweep (src/lib/prewarm.ts) - a no-op unless a # cache bucket just rolled for a recently viewed site. # Brute-force guard on the auth surface, keyed by client IP. Better Auth's # built-in limiter is in-memory - per-isolate on Workers, so effectively no # limiter at all. A single-owner instance has one known account, so this is # the only thing standing between it and offline-speed guessing. [[ratelimits]] name = "AUTH_LIMIT" namespace_id = "1004" simple = { limit = 20, period = 60 } [triggers] crons = ["* * * * *"] [vars] ENVIRONMENT = "development" R2_BUCKET_NAME = "traks-events-dev" R2_ACCOUNT_ID = "4cf68c768770ccda55d287d6

• architecture ↗

  name = "traks-collect-dev" main = "src/index.ts" compatibility_date = "2026-06-01" compatibility_flags = ["nodejs_compat"] # --- Dev (local-first: wrangler dev, shared state in <root>/.wrangler-state) --- [[d1_databases]] binding = "DB" database_name = "traks-db-dev" database_id = "cd0ff4bb-5cc4-4002-a259-be02b3234e29" migrations_dir = "../api/src/db/migrations" # Per-site-key flood guard (counted per colo). Pure abuse backstop - # there are no product quotas. 100/s per colo per site key. [[ratelimits]] name = "RATE_LIMIT" namespace_id = "1001" simple = { limit = 6000, period = 60 } # Ingest failure counters (live-DO write failures, pipeline send failures), # queryable via the Analytics Engine SQL API to spot sites outgrowing their # per-site Durable Object before it becomes an outage. [[analytics_engine_datasets]] binding = "METRICS" dataset = "traks_collect_metrics_dev" # Hot-path live stats: one SQLite-backed Durable Object per site, written at # ingest, read by the api worker for "today"/realtime dashboards. [[migrations]] tag = "v1" new_sqlite_classes = ["SiteLiveStore"] [[durable_objects.bindings]] name = "LIVE" class_name = "SiteLiveStore" # Pipelines *stream* binding - events are sent to the stream, the pipeline # moves them into the Iceberg sink. (`stream` replaced the deprecated # `pipeline` key in June 2026.) [[pipelines]] binding = "EVENTS" stream = "f0ee6ab42aa7462094f374857e996b47" # traks_events_dev_stream (dev) [vars] ENVIRONMENT = "development" # The platform ships to customers as a release bundle; the ONLY install path # is the traks.dev deploy wizard. There is no wrangler prod deploy - our own # instance (and any staging one) is installed through the wizard like any # other customer. Dev config above is for local iteration only.

• architecture ↗

  name = "traks-api-dev" main = "src/index.ts" compatibility_date = "2026-06-01" compatibility_flags = ["nodejs_compat"] # Dashboard requests are back-end bound: each one makes several sequential hops # to D1, the live Durable Object and R2 SQL, none of which live at the edge. # Running near the data beats running near the viewer here - the opposite of # the collect worker, which stays at the edge because ingest latency is felt on # the visitor's page. [placement] mode = "smart" # --- Dev (local-first: wrangler dev, shared state in <root>/.wrangler-state) --- # Local dev serves the SPA from vite (:5012, proxying /ap

• architecture ↗

  ▼ zero ingest delay, ms queries Iceberg sink → R2 Data Catalog serves: today, realtime table `traks.events` ▲ (zstd parquet, 60s roll, │ auto compaction + │ snapshot expiration) │ ▼ │ COLD PATH: R2 SQL ◄── api Worker (apps/platform/api) ── Better Auth, D1 metadata serves: 7d/30d/90d/1y/all ▲ today/realtime → DO (edge-cached 5-15 min) │ history → R2 SQL │ (DO failure → R2 SQL fallback) web dashboard (apps/platform/web) ``` ### How the pieces fit - **`apps/platform/collect`** — ingest Worker. Validates the site key against D1, filters bots, computes the daily-rotating visitor ID, enriches events with Cloudflare geo data, then **dual-writes**: to the Pipelines stream (durable system of record

• architecture ↗

  r "today"/realtime dashboards. [[migrations]] tag = "v1" new_sqlite_classes = ["SiteLiveStore"] [[durable_objects.bindings]] name = "LIVE" class_name = "SiteLiveStore" # Pipelines *stream* binding - events are sent to the stream, the pipeline # moves them into the Iceberg sink. (`stream` replaced the deprecated # `pipeline` key in June 2026.) [[pipelines]] binding = "EVENTS" stream = "f0ee6ab42aa7462094f374857e996b47" # traks_events_dev_stream (dev) [vars] ENVIRONMENT = "development" # The platform ships to customers as a release bundle; the ONLY install path # is the traks.dev deploy wizard. There is no wrangler prod deploy - our own # instance (and any staging one)

• architecture ↗

  events # warehouse (R2 SQL over traks-events-dev) is a real cloud dependency. [[d1_databases]] binding = "DB" database_name = "traks-db-dev" database_id = "cd0ff4bb-5cc4-4002-a259-be02b3234e29" migrations_dir = "src/db/migrations" # Cross-script binding to the collect worker's live-stats Durable Object # (hot path for "today"/realtime queries). The collect worker owns the class. [[durable_objects.bindings]] name = "LIVE" class_name = "SiteLiveStore" script_name = "traks-collect-dev" # Global (cross-colo) result cache for R2 SQL dashboard queries. Layered # behind the per-colo Cache API: a scan any colo already paid for is reused # worldwide for the TTL. On workers.dev

• architecture ↗

  ult) the # Cache API is a no-op, so this KV namespace is the only result cache. [[kv_namespaces]] binding = "R2SQL_CACHE" id = "fc5eb93cfb8f4cb18969af2ccd4f9ea5" # Query telemetry: one row per R2 SQL cache decision (wall ms, rows, outcome). [[analytics_engine_datasets]] binding = "METRICS" dataset = "traks_api_metrics_dev" # Every minute: the pre-warm sweep (src/lib/prewarm.ts) - a no-op unless a # cache bucket just rolled for a recently viewed site. # Brute-force guard on the auth surface, keyed by client IP. Better Auth's # built-in limiter is in-memory - per-isolate on Workers, so effectively no # limiter at all. A single-owner instance has one known account, so this

• architecture ↗

  # Query telemetry: one row per R2 SQL cache decision (wall ms, rows, outcome). [[analytics_engine_datasets]] binding = "METRICS" dataset = "traks_api_metrics_dev" # Every minute: the pre-warm sweep (src/lib/prewarm.ts) - a no-op unless a # cache bucket just rolled for a recently viewed site. # Brute-force guard on the auth surface, keyed by client IP. Better Auth's # built-in limiter is in-memory - per-isolate on Workers, so effectively no # limiter at all. A single-owner instance has one known account, so this is # the only thing standing between it and offline-speed guessing. [[ratelimits]] name = "AUTH_LIMIT" namespace_id = "1004" simple = { limit = 20, period = 60 }