Offen is web analytics built around a different bargain: the operator gets aggregate insight, and the visitor keeps control of their own data. Collection is opt-in, the data is encrypted end to end, and every user gets an Auditorium — a page on the same installation where they can see exactly what was recorded about them, delete it, or opt out entirely. There are no third-party cookies and no data leaves your server.

Key capabilities

• Opt-in by design — nothing is collected until a visitor actively consents, and the consent can be withdrawn at any time.
• The Auditorium — a first-party page that shows a user their own page views, sessions and referrers, in plain language, with a delete button.
• End-to-end encryption — usage data is encrypted with keys the operator does not hold in usable form for individual records, so a database dump is not a privacy incident.
• First-party cookies only — no third-party domains, no fingerprinting, no cross-site profiling.
• Automatic expiry — events are deleted on a schedule (six months by default in a standard deployment).
• Offen Protocol and consent tool — the wider project also publishes a consent-banner implementation and an open protocol for handling encrypted usage data.

Where it fits

Offen is Apache-2.0 licensed, ships as a single Go binary with PostgreSQL or MySQL behind it, and is usually run with Docker Compose. It is a deliberately small product: traffic, referrers, pages, sessions, browsers and countries, plus retention — not funnels, not full product analytics. The project describes its components as having reached maturity in 2024; releases since then have been maintenance rather than new features, which is worth knowing before you standardise on it.

Alternatives in the directory

• Plausible Analytics — cookieless, aggregate-only analytics with a larger feature set.
• Umami — lightweight self-hosted analytics, simpler consent model.
• Matomo — the heavyweight option when you need full visitor-level reporting.