Fathom Analytics

Build me a privacy-first web analytics service to replace Fathom Analytics. Requirements: - Node + Express + better-sqlite3, one small app I deploy on my VPS behind Caddy or nginx. - The tracker: a single script tag under 2 KB that sends pageview beacons (path, referrer, screen width) with navigator.sendBeacon. No cookies. - Count unique visitors without storing personal data: hash IP + user agent with a salt that rotates daily, then drop the raw values. - Filter obvious bots against a user-agent blocklist before counting. - Dashboard page: pageviews, uniques, top pages, top referrers over 7/30/365 days, one Chart.js line chart plus tables. Protected by a single bearer token from .env, no user accounts. - Retention: raw events kept 30 days, daily rollups kept forever, pruned by a nightly node-cron job. - No cookies, no personal data at rest, no telemetry of its own. - Out of scope: email reports, team seats, billing. One site, or a short site list in config. - README: deploy steps, adding the script tag, and a plain note that this is polite analytics, not a legal compliance product.