GhostlyX

The challenge

GhostlyX is a privacy-first, cookie-free web analytics SaaS, and a genuine alternative to Google Analytics for site owners who would rather not hand their visitors to an advertising company or bolt a consent banner onto every page. GhostlyX is also Varsuite's own product: we designed, built and run it in-house rather than for a client.

Building it was hard for two reasons, and neither was the dashboard. The first is that with no cookie, the privacy constraint becomes the engineering problem. There is no durable visitor id, only an anonymous hash that rotates at midnight, so sessions, bounce rate and entry and exit pages must be rebuilt from that stream, within a single day's worth of it. The second is that the analytics product is only the visible tenth of a SaaS. Behind the charts sit subscription tiers and a payment processor, trials that expire, teams that need inviting, uptime that needs watching, backups that need taking and an admin panel to run it all from. Each is a project on its own.

What we built

Varsuite designed and built GhostlyX on Laravel, with a secure internal admin panel, a modern interface and real-time updates.

• Cookie-free by construction, not by policy. GhostlyX needs no cookie banner because it stores nothing on a visitor's device to identify them: the tracking routes have Laravel's session and cookie middleware stripped out, so a beacon cannot set a cookie. Under UK PECR, ePrivacy and GDPR, consent is triggered by storing or reading anything on a device that is not strictly necessary, and the only thing GhostlyX ever stores or reads is the visitor's own opt-out flag, which is exempt. Visitors are counted with a SHA-256 hash of IP, user agent, site ID and the date, rotating nightly, with no IP address column in the analytics schema.
• Privacy signals honoured before anything is written. Global Privacy Control and Do Not Track are checked in the browser before the script binds a listener, and again on the server as the collector's first statement. A regression test asserts that a visitor sending either signal never reaches the database.
• Sessions rebuilt in SQL, not guessed at. GhostlyX derives visits from the raw pageview stream using SQL window functions, spotting a thirty minute gap between hits to mark where one visit ends and the next begins. One query pattern gives visits, bounce rate, entry and exit pages, with no session table. Goals, funnels, UTM reporting, heatmaps, A/B testing and session replay sit on top, and the Traffic Map hides any city with ten or fewer visitors, so a hotspot can never resolve to a person.
• Self-serve billing on four plans. Free, Pro, Business and Scale, with one service deciding every limit: site counts, pageview caps, team seats, uptime monitors and retention (one month on Free, sixty on Scale). Stripe Checkout, billing portal, invoice PDFs and 14-day trials, with downgrades landing at the end of the period rather than stranding someone mid-month.
• Teams, sharing and white-label. Four roles per site (owner, admin, editor and viewer), platform-level invitations, share links that need no login and can be locked behind a password, and custom domains so agencies can brand the reports they hand over.
• A marketing site and an admin control room. Over a hundred public pages: 23 feature pages, 21 competitor comparisons, 23 integration guides and 27 glossary terms, with structured data across 44 views and IndexNow pinging the search engines the moment a post publishes. Behind it, a secure internal control room for MRR, churn, trial conversion, support tickets and impersonation.

The GhostlyX API, MCP server and WordPress plugin

GhostlyX ships a REST API with ability-scoped access tokens, an MCP server whose eleven tools let an AI agent ask about traffic, uptime, goals and funnels directly, and a WordPress plugin generated on demand as a ZIP carrying the site's tracking ID.

How GhostlyX runs itself, from uptime checks to encrypted backups

Twenty-three scheduled commands handle the unglamorous half: uptime checks at each plan's interval (one minute on Scale, five on Business), alerting only after three consecutive failures, retention pruning per plan from 02:00, a GDPR sweep through the 03:00 hour and AES-256 encrypted backups every six hours. Thirty-five notification classes go out through Resend, every one rate limited and logged, from expiring trials to win-back, and more than 2,600 tests sit underneath the lot.

GhostlyX: a complete privacy-first analytics SaaS, designed and built by Varsuite on Laravel, with cookie-free tracking enforced by the routing, sessions rebuilt in SQL, four self-serve plans on Stripe, teams, sharing, uptime monitoring and an admin control room.

The result

The before and after is simple. Before GhostlyX, measuring a website with a mainstream analytics tool meant a consent banner, a cookie, a persistent identifier and a conversation about data protection. With GhostlyX the banner is gone, because nothing is stored to identify the visitor, and the numbers still answer the same questions.

GhostlyX runs at ghostlyx.com as a finished software business. A customer signs up, picks a plan, pays, invites their team and shares a report without ever speaking to anyone. The point is not that we built an analytics dashboard. It is that we built the company around it.

See it in action at ghostlyx.com.