MIT-licensed web and product analytics in TypeScript
Umami is open source web analytics, MIT-licensed and written in TypeScript. A script on your pages reports every view to an Umami server, either self-hosted or on Umami Cloud. The project says it sets no cookies and stores no personal data, and its FAQ spells out what it does record: page views, referrers, browser, operating system, device type and country. Since v3 Umami bills itself as "web and product analytics", adding funnels, journeys, retention, revenue, session replays and heatmaps to the traffic numbers.
The comparison of self-hosted web analytics tools shows how much less Umami asks for than the tools built on ClickHouse.
Two containers, short links and email-open pixels
- Two containers: the repository's
docker-compose.ymlstarts Umami and PostgreSQL, nothing else.DATABASE_URLis the only required variable; Redis is optional and meant for high-traffic sites or multiple instances - MIT all the way: the server and the tracking script share one permissive license, with no copyleft obligations
- Events from HTML: a
data-umami-eventattribute on a button or link records the click, andumami.track()takes over when JavaScript is needed - Short links and pixels: a redirect link counts clicks, and an invisible image counts email opens
- Product reports in the free edition: funnels, journeys, retention, cohorts and revenue run on a self-hosted instance, session replays and heatmaps included
PostgreSQL only, untagged clicks ignored, visitors reset monthly
PostgreSQL only since v3. Version 3.0.0 (November 7, 2025) dropped MySQL, so a v2 instance on MySQL has to move to PostgreSQL before upgrading; the project publishes a migration guide. The README still lists Node.js 18.18, but the v3.1.0 release notes raise the floor to Node.js 22 for Prisma 7.
Only tagged clicks are counted. The tracker only counts clicks on elements carrying data-umami-event, so outbound links, downloads and mailto: links stay off the dashboard until someone tags them. Plausible counts outbound links and file downloads without a custom event.
Visitors whose blocker filters the script are missing too. The docs admit that some blocklists catch anything with "analytics" in its name, and suggest renaming both the script (TRACKER_SCRIPT_NAME) and the collection endpoint (COLLECT_API_ENDPOINT). GoAccess has no such blind spot: it reads the web server's access logs, which record every request whether or not a script ran.
A visitor who returns next month counts as new. With no cookie to rely on, Umami recognizes a visitor by hashing the website ID, hostname, User-Agent and other data with a salt that changes at the start of each month (adjustable through SALT_ROTATION). Two visits on either side of a month boundary show up as two visitors. Visit duration is only computed for visitors who view more than one page.
Log and Google Analytics imports stay on Matomo's side. Matomo imports Apache, Nginx or IIS access logs without any JavaScript, and documents importing Google Analytics history from both Universal Analytics and GA4. Umami's documentation covers neither: Umami Cloud only imports an export from a self-hosted Umami instance or CSV files, from the Pro plan up. Umami's own comparison page with Matomo makes the opposite case, citing a simpler setup and listing funnels, journeys, session replay and heatmaps as included, where it files them under Matomo's premium features.
The free Umami Cloud plan keeps six months of history. Hobby ($0) covers one website and 100,000 events. Pro ($20 a month) goes to two years, and Business ($200 a month) to five years, with session replays and heatmaps added. A self-hosted instance keeps its data indefinitely unless someone deletes it.
Four minor releases since 3.0.0. Version 3.1.0 shipped in April 2026, 3.2.0 in June, 3.3.0 in August and 3.4.0 on September 17. Each one carries schema migrations that run during the build.