Shynet

Self-hosted privacy analytics, honestly reviewed. No marketing fluff, just what you actually get when you run it yourself.

TL;DR

• What it is: Open-source (Apache-2.0) web analytics that tracks page views, sessions, and user behavior without cookies, without JavaScript as a hard requirement, and without sending your visitors’ data to anyone [1][4].
• Who it’s for: Non-technical founders and indie developers who want Google Analytics-style data without the privacy compliance headache — and who are comfortable deploying a Docker container or willing to pay someone who is [1].
• Cost savings: Google Analytics is free but trades your visitors’ data to Google. Plausible charges $9/mo, Fathom $14/mo, and Cloudflare Web Analytics is free but ties you to Cloudflare’s infrastructure. Shynet self-hosted runs on a $5–6/mo VPS with unlimited sites and unlimited traffic [4].
• Key strength: It works without cookies and without JavaScript — a 1×1 tracking pixel fallback means you collect data even when visitors block scripts. Because you host it yourself, it doesn’t appear on standard ad-block lists [1].
• Key weakness: The project has been quiet for over a year — last commit is stale, open issues sit at 48, and the README hasn’t changed in a while [5]. This is a “good enough and done” tool, not an actively developed platform. If you need real-time dashboards, funnel analysis, or event tracking, look elsewhere.

---

What is Shynet

Shynet is a self-hosted web analytics platform. You drop a small script tag (under one kilobyte) on your site, point it at your own server, and it starts collecting page views, sessions, referrers, device types, and geographic data — all without cookies [1][4].

The name is a portmanteau of “Skynet” and “shy” — the idea being it gives you Skynet-level surveillance of your own traffic while being shy enough not to track your visitors across the open web [README]. That framing is a bit cheeky, but accurate: Shynet collects what you’d expect from a basic analytics tool, stops before it gets creepy, and keeps all of it on infrastructure you control.

It’s built with Django and Python, deployable as a single Docker container, and designed to run comfortably on the smallest tier of a $5 VPS for personal projects and small-to-medium sites [1][README]. For higher traffic, it supports horizontal scaling via Kubernetes, Redis caching, and separate worker processes for database I/O [README].

The project is created and maintained by R. Miles McCain, with contributions from a small community. As of this review it sits at 3,129 GitHub stars and 205 forks [4]. It is not backed by a company, does not have a managed SaaS offering, and does not charge anything. This is purely a self-hosted open-source tool — which is both the appeal and the risk.

---

Why people choose it

The core argument for Shynet is privacy compliance without giving up useful data. Most analytics tools force a binary: use Google Analytics (free, comprehensive, your visitors’ data goes to Google), pay for a privacy-first SaaS like Plausible or Fathom, or go dark entirely. Shynet is the third option — self-hosted, no cookies, no third-party data sharing, Apache-licensed [1][4].

Versus Google Analytics. GA4 requires cookie consent banners in the EU and UK under GDPR and ePrivacy rules. Shynet avoids cookies entirely — no cookie notice required, no consent friction for your visitors [1]. The trade-off is obvious: GA4 is free, has decades of polish, integrations with everything, and more metrics than you’ll ever use. Shynet has the basics.

Versus Plausible and Fathom. Both are legitimate privacy-first analytics SaaS products. The pitch for Shynet over either of them is pure cost: Plausible starts at $9/mo, Fathom at $14/mo, and both scale with pageview volume. Shynet on a $6 Hetzner VPS is ~$72/year regardless of traffic and regardless of how many domains you track [4]. The downside: Plausible and Fathom are actively developed with real teams behind them. Shynet is not.

The ad-blocker angle. Because you host Shynet on your own domain and infrastructure, its script URL is unique to your server — it doesn’t match the block lists that kill Google Analytics, Hotjar, or Plausible’s CDN-hosted scripts. LinuxLinks flags this explicitly: “Generally not blocked — because the software is self-hosted it tends not to be on ad block lists” [1]. This matters. Depending on your audience, 30–40% of desktop visitors run some kind of content blocker. Shynet doesn’t fully solve that (determined users can still block any script), but it performs significantly better than analytics platforms that share a blocklist-flagged CDN.

RudderStack integration. This one is genuinely interesting: RudderStack — a major open-source customer data platform — ships native Shynet destination support [2]. That means if you’re already routing events through RudderStack from your web app, mobile apps (iOS, Android, React Native, Flutter), or server-side sources, you can send that data to Shynet without touching your site’s tracking script. The supported event types are page and track, with cloud mode and device mode both available [2]. This lifts Shynet from “simple page-view counter” into something you can wire into a broader data infrastructure — which is unexpected for a 3K-star indie project.

---

Features

Based on the README and third-party coverage:

Tracking options:

• JavaScript tracking script — under 1KB, doesn’t look like a typical tracking script [1][README]
• Fallback to a 1×1 transparent pixel for visitors without JavaScript [1][README]
• Because it’s self-hosted, generally avoids ad-block lists [1]
• Primary-key integration — associate Shynet sessions with your app’s user accounts (useful for SaaS products tracking logged-in behavior) [README]

Metrics collected:

• Hits (page views) and sessions [1]
• Page load time [1]
• Bounce rate [1]
• Session duration [1]
• Referrers [1]
• Page-level popularity (which pages get the most traffic) [1]
• Operating system (from user agent) [1]
• Browser (from user agent) [1]
• Geographic location and network (from IP) [1]
• Device type — desktop, tablet, or mobile (from user agent) [1]

Architecture and deployment:

• Single Docker container for small deployments [1][README]
• Kubernetes support for high-traffic installations with Redis caching and separate worker nodes [1][README]
• Built on Django — migrations, updates, and backups follow standard Django patterns [README]
• Multi-user, multi-site — one instance can serve multiple users each tracking multiple domains [1][README]
• Two-factor authentication support [merged profile]

Workflow:

• Share services (sites) with other users — collaboration is built in [README]
• Full account management via Django Allauth [README]

What it does not do:

• No event tracking beyond page views (no button clicks, form submissions, funnel steps)
• No real-time dashboard
• No heatmaps or session recording
• No A/B testing
• No alerts or anomaly detection
• No conversion tracking
• No data exports beyond what Django admin exposes

This is a page-view analytics tool. It answers “how many people visited, from where, on what device, and for how long.” It does not answer “did they complete a purchase” or “where did they drop off in my funnel.”

---

Pricing: SaaS vs self-hosted math

Shynet has no SaaS offering. The pricing math is purely infrastructure:

Shynet (self-hosted):

• Software: $0 (Apache-2.0 license) [4]
• VPS to run it: $5–6/mo on Hetzner, Contabo, or DigitalOcean (1GB RAM is enough for low-to-medium traffic)
• Your time to deploy and maintain it

Privacy-first analytics SaaS alternatives:

• Plausible: $9/mo (10K pageviews), $19/mo (100K), $69/mo (1M+)
• Fathom: $14/mo (100K pageviews)
• Cloudflare Web Analytics: $0 (but requires Cloudflare DNS)
• Simple Analytics: $9/mo

Google Analytics 4: Free, but requires cookie consent infrastructure under GDPR (OneTrust or similar runs $23–$99/mo for small sites, not counting legal time to configure it correctly).

Concrete math for a small SaaS or blog: Say you’re running 3 sites, each getting ~50K pageviews/month. On Plausible that’s $19/mo regardless of site count. On Fathom, $14/mo for up to 100K combined. On Shynet self-hosted on a $6 VPS, all three sites run for $72/year total, with no pageview limits [4].

Over 3 years: Plausible ≈ $684. Fathom ≈ $504. Shynet self-hosted ≈ $216 + the afternoon you spent deploying it.

The math is clear. The caveat is equally clear: you are now responsible for keeping the server running, keeping Django updated, and troubleshooting when things break. That’s not a trivial cost if your time is expensive.

---

Deployment reality check

The README’s primary install path is Docker Compose. There’s a docker-compose.yml in the repository, a TEMPLATE.env for environment variables, and a GUIDE.md for setup steps. There are also Kubernetes manifests in the kubernetes/ directory for larger deployments [README].

What you actually need:

• A Linux VPS with 1GB RAM minimum (Shynet is lightweight — this is fine for most personal and small-business sites)
• Docker and docker-compose
• A domain name and a reverse proxy (Caddy or nginx) for HTTPS
• PostgreSQL (bundled in docker-compose or external)
• Optional: Redis if you’re scaling horizontally [1][README]

What can go sideways:

• The project’s last commit is over a year old [5]. Django security updates require manual intervention — you will need to periodically rebuild the Docker image or pin to a known-good version. This is not a “set it and forget it” situation from a security maintenance perspective.
• There are 48 open GitHub issues [5]. The maintainer appears to be largely inactive. If you hit a bug, the community is small and responses may be slow.
• No official hosted demo — you have to deploy it to evaluate it. The README does link to office hours with the creator, which is unusual and a nice touch, but doesn’t substitute for active maintenance.
• The osssoftware.org listing calls out that Shynet “hasn’t been tested with ultra-high traffic sites” and that it “requires a fair amount of technical know-how to deploy and maintain” [4] — the README itself says the same thing.

Realistic setup time:

• Technical user comfortable with Docker: 30–60 minutes to a working instance.
• Non-technical founder following a guide: 3–5 hours including domain, HTTPS, and learning curve.
• If you’ve never touched a VPS: plan a full day or pay a developer to do it once.

---

Pros and cons

Pros

• No cookies, no consent banners. Shynet’s tracking method doesn’t require cookies, so EU/UK sites can skip the cookie notice for analytics entirely [1][4]. This alone removes significant legal and UX overhead.
• Apache-2.0 license. Genuinely open source, no usage restrictions, no “Fair-code” surprises. Use it commercially, embed it in client projects, do whatever you want [4].
• Generally not blocked by ad blockers. Self-hosted URL means it doesn’t match standard block lists — you capture traffic that other analytics tools miss [1].
• Runs on a single tiny VPS. A $5–6/mo server handles a reasonable personal or small business site. No pageview limits, no per-site pricing [4].
• RudderStack destination. If you’re using RudderStack already, you can route events to Shynet from web, mobile, and server sources without additional client-side code [2].
• Scales to Kubernetes. When you outgrow the single-container setup, the architecture supports horizontal scaling with Redis and separate workers [1][README].
• Multi-user, multi-site. One instance can serve a whole team or agency tracking multiple client sites [README].
• JavaScript fallback. The 1×1 pixel fallback means you collect some data even from visitors who block all scripts [1].

Cons

• Effectively unmaintained. Last commit is stale, 48 open issues, no active development [5]. You’re adopting a snapshot of software that isn’t moving forward. Security patches from Django won’t land automatically.
• No event tracking. If you need to track anything beyond page views — purchases, signups, form completions — Shynet can’t help you. It measures visits, not actions [README].
• No real-time data. Sessions and hits are aggregated, not streamed. There’s no live view of who’s on your site right now.
• Limited integrations. Beyond RudderStack [2], there are no native integrations with advertising platforms, CRMs, or email tools. There’s no GA4 import, no UTM dashboard, no conversion pixels.
• Small community, slow support. With 3,129 stars and a largely inactive maintainer [5], you’re on your own if you hit an edge case.
• No SaaS option. If you want privacy-first analytics without the ops overhead, Shynet can’t help — you deploy it or you don’t use it. Plausible and Fathom both offer managed hosting for exactly this audience.
• Setup is not beginner-friendly. The README says so directly: “it requires a fair amount of technical know-how to deploy and maintain” [4]. For a non-technical founder, this is a real barrier.

---

Who should use this / who shouldn’t

Use Shynet if:

• You’re a developer or technically-capable founder who wants basic analytics without any third-party data exposure.
• You’re running personal projects or a portfolio of small sites and want one $6/mo server to cover all of them with no per-site or per-pageview fees.
• You’re in an EU/UK market and want to skip cookie consent entirely for your analytics layer.
• You’re already using RudderStack and want a self-hosted analytics destination [2].
• You’re comfortable accepting that the software won’t receive new features — you want a stable, “done” tool, not a roadmap.

Skip it (pick Plausible or Fathom) if:

• You want privacy-first analytics without managing servers. Both are genuinely privacy-respecting SaaS products with active development, and the cost ($9–14/mo) is reasonable for most small businesses.
• You need real support. Plausible and Fathom have teams behind them.
• You want UTM tracking, custom event tracking, or any funnel analysis.

Skip it (pick Umami) if:

• You want an actively maintained self-hosted analytics tool with a modern UI, event tracking, and real-time dashboards. Umami is the most direct competitor and has a significantly more active codebase.

Skip it (pick Matomo) if:

• You need enterprise-grade analytics with goals, funnels, e-commerce tracking, A/B testing, and a full GA replacement. Matomo is heavier and more complex to self-host, but it’s a real analytics platform.

Skip it (stay on Google Analytics 4) if:

• You’re not in a privacy-regulated market, you need conversion tracking and Google Ads integration, and you don’t mind your visitors’ data going to Google.

---

Alternatives worth considering

From the osssoftware.org listing and related tools [4][1]:

• Umami — the strongest direct alternative. Actively maintained, modern UI, cookie-free, event tracking, PostgreSQL or MySQL backend. Self-hosted or managed cloud. More actively developed than Shynet [1].
• Plausible — privacy-friendly SaaS with a self-hosted option (AGPLv3). More polished, actively developed, $9/mo managed or self-hosted for free. The go-to for teams who want privacy without ops work.
• Matomo — the full-fat GA replacement. More features than you probably need, heavier to run, but genuinely powerful. Has a SaaS option and a self-hosted community edition.
• GoAccess — log-file based analytics, no tracking script at all. Processes your nginx/Apache access logs. Completely different architecture but zero privacy concerns by definition [1].
• GoatCounter — lightweight, cookie-free, self-hostable. Similar positioning to Shynet but with a more active maintainer [1].
• Ackee — privacy-friendly analytics built on Node.js with a focus on minimalism. Another Shynet alternative in the same weight class [1].
• Fathom — SaaS only, Canadian company, GDPR-compliant, $14/mo. No self-host option.

For a non-technical founder who wants to escape Google Analytics: the realistic shortlist is Plausible (managed, easiest) or Umami self-hosted (free, actively developed, Docker-deployable). Shynet works, but you’re betting on software that isn’t moving.

---

Bottom line

Shynet does exactly what it says: privacy-friendly, cookie-free, self-hosted web analytics with no third-party data sharing. The metrics it collects are honest and useful — sessions, bounce rate, referrers, device types, and geo data. The tracking script is tiny, doesn’t trigger most ad blockers, and doesn’t require a cookie consent banner. The Apache-2.0 license is clean. The infrastructure footprint is minimal.

The honest caveat is that Shynet is functionally a completed project rather than an active one. The last commit is stale, open issues accumulate without responses, and the feature set hasn’t moved in years [5]. For the specific use case it targets — a developer who wants basic traffic data on their own infrastructure with zero privacy compliance overhead — it still works fine. But before you commit to it, check Umami. Umami does more, is actively maintained, and deploys just as easily. Shynet made sense as a first-mover in the self-hosted privacy analytics space; in 2026, it has real competition from tools that didn’t exist when it was built.

If the deployment step is the blocker regardless of which tool you pick, that’s exactly what upready.dev’s studio deploys for clients — one-time setup, you own the infrastructure, no recurring SaaS bill.

---

Sources

1. LinuxLinks — “Shynet — privacy-friendly and cookie-free web analytics”. https://www.linuxlinks.com/shynet-privacy-friendly-cookie-free-web-analytics/
2. RudderStack Docs — “Shynet destination documentation”. https://www.rudderstack.com/docs/destinations/streaming-destinations/shynet/
3. OSSsoftware.org — “Shynet”. https://osssoftware.org/tools/shynet/
4. Awesome Open Source — “Channels Alternatives (includes Shynet listing)”. https://awesomeopensource.com/project/django/channels

Primary sources:

• GitHub repository and README: https://github.com/milesmcc/shynet (3,129 stars, Apache-2.0 license)