Simple Analytics is a privacy-first analytics tool with a strong mission: never invade the privacy of your visitors. We just show you the essentials: page views, referrers, top pages, and devices. We don't use cookies. We don't collect any personal data. So no cookie banners or GDPR to worry about. When a service is free you are the product. We won't ever sell your data. As a result, we require a subscription.
As our public scripts are very important in our mission to privacy we decided to make the source code available. We use the MIT license which is short and to the point. It lets you do almost anything you want with this project, like making and distributing closed-source versions. See LICENSE for more info.
If you want to contribute, you probabaly want to contribute to our /src/default.js or /src/auto-events.js files. These files compile into a few versions of our script by compile.js. They end up on our CDN and custom domains.
In default.js you see some weird syntax in the comments. For example, /** if ignorepages **/ [some code] /** endif **/. These comments are converted to handlebars like this: {{#if ignorepages }} [some code] {{/if}}. In this case, ignorepages is a variable used in minify.js that takes care of what functionality to show in what script. Our main script is the latest.js script which includes all features. We also have a light.js script that obviously doesn't.
If you contribute, make sure to use pnpm run build, copy the script to a website, and check if it works correctly.
Install the pinned Node and pnpm versions, run pnpm install --frozen-lockfile, and then use pnpm run watch. Every file will be validated and compiled on save. We minify our scripts with UglifyJS, a well-known JavaScript minifier.
The most important file of the repository is /src/default.js
Each release is one script version, vN. Its SRI file (sri/vN.js) never changes after publication, and the latest files serve the newest deployed release. dist/ is build output and is not committed.
- Open a pull request on
mainthat bumpsVERSIONincompile.js. - Merging it runs the Release workflow. It builds the scripts once, runs the unit and BrowserStack tests on those files, and publishes GitHub Release
vNwithscripts-vN.tar.gz.
pnpm run deployThe interactive CLI starts in dry-run mode by default. You pick a release (the newest by default), and the CLI downloads its scripts-vN.tar.gz and checks the file against the SHA-256 digest GitHub recorded. It then shows the release each destination runs now, every affected path, and the first-line script-header diff. It never builds or reads local dist/ files. Choosing a real deployment requires a clean repository and a second confirmation. To roll back, deploy an older release; published SRI files are never overwritten.
After a real deployment that includes latest.js, the CLI records a GitHub deployment for each destination (cdn and custom-domains), so Deployments shows what is live. Deployments of only auto-events, SRI or light aren't recorded, because the destination keeps running its recorded release. It runs gh, or the command in DEPLOY_GH_COMMAND.
CDN writes use BUNNY_SCRIPTS_ACCESS_KEY and BUNNY_SCRIPTS_ACCOUNT_KEY from .env. Caddy reads and writes require SSH access to user@esapp05.simpleanalytics.com.
We run our public script on a live, representative matrix of browsers and real devices. Simple Analytics supports vendor-maintained browser, OS, and device versions and continues compatibility testing for two years after published end of life. Older browser versions with more than 0.1% global usage remain covered. We get amazing sponsorship from BrowserStack. Thanks, BrowserStack!
Feel free to drop any issues you have with our open-source scripts. If you want to contact us you can also use our contact form or email listed here: simpleanalytics.com/contact.