Self-Hosted Analytics With Umami: Privacy-First

Google Analytics answers a lot of questions, but it also loads a heavy script, sets cookies that trigger consent banners, and hands your visitor data to a third party whose interests are not yours. Umami gives you the important numbers — page views, referrers, sessions, countries — from a script that weighs a couple of kilobytes, sets no cookies, and touches nothing outside your own box.

For a small site the analytics decision is really a trust decision. With Umami you decide what gets captured, how long it stays, and who can see the dashboards. There is no surprise cross-site tracking, no behavioral profiling feeding a parent ad network, and no reason for a cookie banner at all, because nothing personal is stored.

Because it is cookieless and privacy-respecting, Umami is a common choice for self-hosters and small businesses who want real usage data without the legal overhead. This guide deploys it with its Postgres backend and wires the tracking script into a typical site.

The Umami Stack

Umami is a Node app plus a Postgres database. The Compose file is short and stable, and because it separates the tracker, the database, and the dashboard cleanly, scaling later is a matter of adding a read replica:

services:
  umami:
    image: ghcr.io/umami-software/umami:postgresql-latest
    container_name: umami
    environment:
      - DATABASE_URL=postgresql://umami:secret@db:5432/umami
      - DATABASE_TYPE=postgresql
      - APP_SECRET=generate-a-long-random-string
    depends_on:
      - db
    ports:
      - "127.0.0.1:3000:3000"
    restart: unless-stopped

  db:
    image: postgres:16-alpine
    environment:
      - POSTGRES_DB=umami
      - POSTGRES_USER=umami
      - POSTGRES_PASSWORD=secret
    volumes:
      - ./db:/var/lib/postgresql/data
    restart: unless-stopped

Generate a strong APP_SECRET with openssl rand -hex 32. The first-run screen lets you create the admin account that owns all websites and dashboards.

Tracking a Site

Add the tracking snippet to each page. Umami provides a unique script URL per website:

<script defer src="https://analytics.example.com/script.js" data-website-id="YOUR_WEBSITE_ID"></script>

The script captures page views automatically. For events like button clicks or form submissions, use the data attribute API:

// registered a custom event named "signup"
window.umami.track('signup', { plan: 'pro' });

Because there is no third-party request to a foreign server, you skip the consent cookie banner in most jurisdictions — visitors simply send one tiny request to your own host.

For WordPress or static sites the integration is equally simple: paste the script into the theme or use the official plugin, and Umami starts collecting within seconds. Because the tracker is tiny and does not block rendering, it has a negligible impact on page speed, which is a welcome contrast to heavier analytics bundles that add noticeable overhead to every page load.

Interpreting the Dashboards

• Live view streams sessions, pages, and referrers in real time.
• Trends compare day-over-day and week-over-week traffic.
• Referrers show which sites drive visits, ideal for judging campaigns.
• Countries use reverse-geolocation on the IP, stored only as a country code.

Umami can also run as a shareable read-only link. Create one per website so a client or colleague sees reporting without a login.

Data Retention and Scaling

By default Umami keeps events in Postgres indefinitely. For a personal site that is fine, but you may want periodic cleanup:

DELETE FROM event WHERE created_at < now() - interval '180 days';

Run that as a scheduled job. If traffic grows dramatically, the design already separates writer (tracking) from reader (dashboard), so adding a read replica later is straightforward.

The one thing Umami will not tell you is per-individual browser behavior, because it cannot see cookies and does not fingerprint users. That is the point: you trade a few deeper analytics features for the enormous simplification of having no personal data to secure, no consent dialog to run, and no data-subject requests to answer. For most small and medium sites that is an excellent trade, and the metrics you still get are the ones people actually act on.

Takeaway

Umami gives you honest, cookieless traffic analytics with a real-time dashboard, no third-party scripts, and no consent-banner overhead. It is small enough to share a VPS with several other self-hosted services.

You can deploy Umami with its Postgres backend on a 1 GB Ubuntu Netbay instance in under a minute — netbayhosts.in.