See the trace.
Never the person.

Two days. Same visitor. No thread between them.

Heatmaps and behavioural sampling are only defensible because the operator self-hosts and holds the data plainly — this is not a claim that Athar is content-blind. What it removes is everything that does not need to exist for that: a persistent identifier, a third-party lookup, a raw IP sitting in a table.

// 1 · once per instance, generated and stored
const instance_secret = random(32 bytes)

// 2 · recomputed once per UTC day
salt = HMAC(instance_secret, "2026-07-31")

// 3 · per beacon — the IP is discarded right after this line
visitor = HMAC(salt, website_id ‖ ip ‖ user_agent)

Every click leaves a trace. Enough of them draw a picture.

That is what a heatmap literally is: hundreds of individual traces, each just a position and a selector, accumulated until a pattern is visible. A pattern is only worth reading over the page it was left on — so Athar draws it over the page.

your-athar-host — Heatmap · /pricing · ~1920px

FIG. 2Click density over the real page. The backdrop is a full-page capture of /pricing at 1920px, uploaded by the operator; the heat is 166 recorded clicks from the seeded instance. Nothing here is arranged by hand — the screenshot pipeline reads the heat canvas's own pixels at the coordinates of each real button and refuses to save the image unless the field is hot there.

How the page gets under the heat

The tracker still records three things per click and nothing else: a position as a percentage of the document, the viewport size, and a short CSS selector. It captures no DOM, no text, no form values, no screenshot — that boundary has not moved, and it is why the backdrop has to come from somewhere else.

/docs/getting-started · no capture

FIG. 3No capture, and it says so. Where no image exists for the selected page and viewport, the view falls back to a wireframe built only from real recorded coordinates, badges itself SCHEMATIC, and never borrows another page's picture to fill the gap.

What a sample carries

• Click — a position, and the CSS selector of the element pressed.
• Scroll — the furthest depth that session reached.
• Attention — dwell time per tenth-of-page band.

What it never carries

• No DOM snapshot, no page text, no automatic screenshot.
• No form values, no keystrokes.
• No session replay — a different feature, deliberately not this one.

Positions are percentages of the document rather than viewport pixels, and the selector rides alongside, which is what keeps a click map meaningful after a redesign.

Everything a self-hosted analytics stack needs. Not much it doesn't.

Umami and Ackee are genuinely MIT and genuinely light, but stop at pageview counting. PostHog has heatmaps and needs ClickHouse, Kafka and Redis behind it. Matomo's heatmap tooling sits behind a paid plugin on a GPL core. MIT-or-Apache, lightweight, with heatmaps, ecommerce and built-in GeoIP in one binary was the specific combination missing — the full comparison is Plate 09.

Tracking

Cookieless by construction. Automatic pageviews including SPA route changes via pushState/replaceState/popstate, custom events, revenue events, and opt-in heatmap sampling. One script tag.

Heatmaps

Click density, scroll depth and attention bands, per page and per recorded viewport width, drawn over an operator-supplied capture of the page or over an honest schematic.

Reporting

Pageviews, unique visitors, sessions, bounce rate, average visit time; top, entry and exit pages; referrers and UTM campaigns; browser, OS, device, screen and language; country, region and city; custom events; realtime active visitors.

Ecommerce

athar.revenue(amount, currency, orderId). Integer minor units per currency, never floats, never summed across currencies.

Geography

In-process GeoIP from a local MaxMind-format .mmdb — no lookup service, no network call. Not bundled, for size and licence; unset simply leaves the location fields empty.

Access control

argon2id (64 MiB, t=2), server-side sessions storing only a SHA-256 of the token, httpOnly SameSite=Lax cookies, double-submit CSRF on every state-changing route, login rate limiting keyed on username and address, owner/editor/viewer roles. Fail-closed throughout.

Hygiene

Bot traffic dropped at ingest rather than recorded. Retention deletes whole visitor sessions past a configurable age, cascading to their events, heatmap samples, revenue rows and page captures — so a purge never leaves orphans to skew a later bounce rate.

SQLite on your laptop. Postgres in the cloud. Same binary either way.

The difference between a box you own and a managed deployment is one config value — database — not a fork. One database/sql implementation serves both engines; a small Dialect rewrites only placeholder syntax and a time-bucket expression. Every migration is written in the subset of SQL both engines accept literally, which is a real constraint on future schema work and the reason the two deployments cannot drift apart.

Standalone

./athar on a home server, NAS or small VPS. Zero setup, storage is one file, loopback-bound by default.

Managed

The same binary against a postgres:// DSN for a pooled deployment. Nothing above the storage layer changes.

Public

Reached through cloudflared, ngrok, your own Ephor, or nginx/Caddy terminating TLS in front of it.

Embedded

frame_ancestors lets a host shell embed the dashboard as an app tile behind its own routing and auth.

Running end to end in about a minute.

Requires Go 1.25+ and Node 22+ to build from source — Node only to minify the tracker and drive screenshots; the dashboard itself is hand-written HTML, CSS and JS embedded straight into the binary, with no bundle to go stale. The result is one static binary. Copy it wherever you like.

# build from source
git clone https://github.com/vul-os/athar.git
cd athar
npm install && npm run build
./athar

# drop one script tag on your site
<script defer src="https://your-athar-host/athar.js"
        data-website-id="YOUR_WEBSITE_ID"
        data-heatmap="true"></script>

Built and exercised end to end. Still young. Both are true.

Status: v0.1.0, early. The core collector, storage, auth and reporting paths are implemented and have been exercised end to end, but this is a young project — expect rough edges, and expect the API surface to move before 1.0.

Three columns rather than two, because there is a real difference between what a released version does, what is on main and not yet cut into a release, and what nobody has written. Collapsing the middle one into either neighbour would be a small lie in one direction or the other.

Kept current release by release: Roadmap → and Changelog →

The specific gap this fills.

In fairness to the table: Umami and Ackee are genuinely light and genuinely MIT, they just stop at pageviews. PostHog is the most feature-complete of the group but is a product-analytics platform first, on a multi-service stack. Matomo's ecommerce is mature and its heatmaps are a paid plugin. Plausible, GoatCounter and OpenReplay are copyleft licences many businesses avoid embedding.

This is the whole trace. All of it.

A heatmap sample in Athar carries three things and no more. Below are those three fields, for you, on this page, computed in your browser in the last second. They are the entire shape of what a heatmap knows about a reader.

On a real install there would be a little more than this alongside — the page path, the referrer, a coarse country from a local database file, your browser and operating system, and one salted hash that cannot be recomputed after midnight. That is the complete list. It is short on purpose, and it is the whole argument.