DEV3 Tallyglass – Cookieless Website Analytics SaaS Laravel Script with Goals, Funnels, Shared Dashboards

Tallyglass is a website analytics product you host yourself, built by DEV3 Technologies on Laravel 12 and Filament 4. You run it as the operator and sell plans by monthly pageviews; each customer is a workspace with its own sites, goals, funnels, shared dashboards, imports, exports and API keys.

What it does

• Cookieless by design. One script under 2 KB (about 1 KB gzipped) sets no cookie and stores nothing in the browser. A visit is told apart by a hash of IP, browser and a random daily salt; the salt is deleted after the day closes, and IPs and user agents are never written to any table or log.
• The Glass Pane dashboard. Unique visitors, pageviews, views per visit, bounce rate, visit duration and a live visitor count over a trend chart with the previous period dashed. Click any referrer, page, country or campaign to filter the whole page, then save the filter as a segment. Sources, pages, locations (a flat tile map), devices, goals and custom events sit in tabbed cards with a searchable details drawer.
• Goals, funnels and retention. Page and event goals with exact, prefix or wildcard matching. Funnels of two to eight steps, ordered or in any order, inside a visit or 24 hours, with drop-off and the pages people left from. Weekly retention cohorts for sites that send their own first-party id, and an honest explainer for those that do not.
• Shared dashboards. Read-only links with an optional password, expiry and widget list. Revoking a link closes it at once, and password guesses are limited per link and address.
• Data in and out. Import daily aggregates from a previous tool (days that already hold data are handled by a rule you choose, imported days are drawn hatched) and export CSV or JSON of the rollups with signed, expiring links. A REST API with workspace keys, scopes and an OpenAPI document, plus server-side events.
• Time zones that behave. Days follow each site's own zone, including the days when the clock changes. Changing the zone never rewrites the past.
• Operator panel. Tenants, plans, subscriptions, invoices and an MRR curve; ingestion health with events per minute, rejections by reason, rollup lag and an abuse queue; a spam referrer list; audited view-only support sessions.
• Plans and quotas. A monthly pageview meter with an 80 percent notice, a soft overage margin and a hard stop, enforced under row locks so parallel traffic cannot overshoot far.

Quality checks

The release passed seven gates on the final code: Larastan level 6 with 0 errors, GATE_PEST, a build inside the page budget, migrations and the full demo seed on MySQL 8 and SQLite, a headless smoke test with seven MySQL race groups (parallel retries of one event, quota overshoot, one session for two parallel first pageviews, parallel rollups, rollups during ingestion, share password guessing, purge during a rollup), an installer test from the zip, and a secret scan. An independent logic review of the visitor hash, ingestion, sessions, rollups, funnels and quota code found issues that were fixed with tests.

What you need to know before buying

• Locations use a simulated geo-IP table by default. Real locations need a GeoLite2 file you download yourself; the reader package (geoip2/geoip2) is a Composer install you run yourself, and no database is bundled.
• Browser, system and device detection covers the major engines; others show as Other. The bundled bot list has about 190 markers.
• Visitors are per-day identities: a returning person counts again the next day, and ranges merge the days. Funnels cannot span days. Filters, funnels and retention read raw events, which are kept for 35 days; older months exist as rollups only.
• Tested to about 5 million pageviews a month on one MySQL server. Above that you need a columnar store (not included).
• You need cron every minute and MySQL 8 or MariaDB 10.6 (rollups use named locks). Reverb is optional; without it live counts poll.
• Payments, mail and geo-IP are simulated until you connect your own. You are the merchant of record for what your customers pay you.
• Server-side events take an explicit IP and user agent from your code: that is personal data you must justify. Cookieless tracking is not legal advice; ask your own counsel.
• Web only: there are no mobile apps. Demo brands, people and domains are fictional.

In the package

The Laravel app with a web installer (/install), prebuilt assets and the tracker, an offline buyer guide in Documentation/, a tenancy and race-check write-up, LICENSE.txt and START-HERE.txt. Six months of support are included. Node.js is not needed to run it.