Open source, but strictly aggregate.
Umami and analyticshq are both open-source and cookieless. The difference is where the line is drawn: Umami v3 moved toward individual-level tracking with session replay and user profiles. analyticshq rotates identity every 24 hours by default instead of monthly, and its visitor timelines are opt-in, pseudonymous and end after 30 days.
Umami vs analyticshq
Point for point.
Where the two part ways.
Both are open source, and the philosophy is where they split
Umami and analyticshq are both MIT-spirited and self-hostable, with cookieless defaults. The difference is the ceiling: Umami now offers individual-level tracking, analyticshq refuses to build it.
Aggregate by default, bounded by design
Umami v3 shipped session replay, heatmaps, individual visitor profiles, and identify() user stitching. analyticshq will never add replay, heatmaps or identify(). Its visitor timelines are off until a site owner turns them on, and even then an id cannot outlive 30 days.
A tighter identity window
Umami’s session salt rotates monthly. analyticshq rotates its per-site hash every 24 hours unless a site opts into timelines, so by default activity cannot be linked across days. Opted in, the window is a fixed block with its key deleted at the end.