Unified analytics · Sponge Theory

Web, product and API analytics. One tool, cookieless, on your own infrastructure.

Real-time, GDPR by construction, and an AI layer that runs exclusively on local models: not a single row of analytics ever leaves your infrastructure.

Try cloud Self-host it

app.oriflux.dev/p/sponge-theory-ai Live

Three domains, one tool

What no tool on the market brings together

Web analytics, product analytics and API analytics usually live in three separate products. Oriflux unifies them on the same data model, the same typed query, the same dashboard.

01 Cookieless, no banner

Web analytics

Unique visitors, page views, time on page
Sources, referrers and UTM campaigns
Visitor geography and technology
Real-time view of who's on the site

02 Events & journeys

Product analytics

Custom events via track()
Step-by-step conversion funnels
Retention and goals (identified users)
Pseudonymous identify, never PII

03 Where web analytics never goes

API analytics

Volume and 4xx/5xx error rates
p50 / p95 / p99 latency per endpoint
By consumer, by caller country
ASGI SDK, < 1 ms overhead per request

Privacy

Cookieless and banner-free, by construction

Compliance isn't a checkbox in the settings — it's in the architecture. Nothing to configure, nothing to negotiate with a DPO.

Zero cookies, zero banner

No persistent identifier in the browser: no cookie, no localStorage. No consent banner to display.

Unique visitor via daily hash

hash(daily_salt, project, IP, user-agent). The salt is destroyed every day — correlating two days is impossible, for us too.

The IP is never stored

Resolved to country / region / ASN at ingestion, then discarded. Never written to a database, never logged.

DNT and GPC honored

Do-Not-Track and Global Privacy Control signals are respected at ingestion: the request answers {"tracked": false}.

identify() rejects PII

Only pseudonymous identifiers are accepted — anything resembling an email or a phone number is rejected at validation.

100% EU data residency

All data stays in Europe. The AI layer runs on the same infrastructure and only ever sees aggregates.

Accepted trade-off: retention and multi-day funnels exist only for identified users; anonymous funnels are scoped to a single session and labeled as such in the interface.

Local AI

An AI layer that lets no data out

Daily insights, narrative digests, natural-language questions: all inference runs on self-hosted models (SPT Models). Never a cloud LLM, never a row of analytics that escapes.

SPT Models · on-prem GPU

Local models only

Chat, embeddings and rerank run on your own GPU infrastructure. No call to any external provider.

Every answer is sourced

Every AI answer cites its numbers and the executed query — you can verify, not just trust.

Typed queries, never free SQL

Natural language compiles to a constrained, validated query object, never to SQL generated on the fly.

The AI only sees aggregates

The model never receives a raw event or an identifier: only numbers that are already aggregated.

Live demo Soon

See for yourself

A public, read-only dashboard powered by the real traffic of sponge-theory.ai. The same numbers, the same real-time view you'd have on your own instance.

The link shows up here as soon as the public view is online.

Open source

The code you deploy is the code you can read

Oriflux is released under the AGPL-3.0 license. No hidden proprietary core, no "enterprise edition" that unlocks the essentials: the public repository is the product.

See the code on GitHub Self-hosting guide

Contributing guide →

AGPL-3.0 ezeeFlop/oriflux