Open source
Privacy you can verify beats privacy you’re asked to trust. The code that runs in your users’ browsers is fully open — read it, fork it, and confirm exactly what is collected and sent. There’s nothing hidden, because there can’t be.
The license split
We don’t call the whole thing “open source” — that would be inaccurate. Two licenses, two jobs.
The split is deliberate: the tracker is permissively open so anyone can adopt and audit it; the engine and surfaces are source-available so the work stays sustainable and can’t be resold as a competing hosted service.
The tracker.js that runs in your users’ browsers. Fully open and forkable — the one piece that touches real people, open so you can verify it line by line.
The analysis engine and the surfaces that read it. Source-available under the Elastic License v2: read it, audit it, run it yourself — just not repackaged as a competing hosted service.
Why it matters
Every privacy promise here is verifiable in the open tracker, not just asserted in a policy:
Don’t take our word for any of it — the source is right there. Read it on GitHub →
Drop the tracker in, point your agent at the hosted API, and close the loop — or self-host the whole thing. Both paths start in one place.