# Build brief — a focused alternative to DataFast

> **Verdict:** Partly, if you narrow it · **Buildability:** 49/100 · **Category:** Analytics
> **Source:** https://www.canitbevibecoded.com/datafast
> Independent editorial assessment from Can It Be Vibe Coded? Not affiliated with, endorsed by, or derived from DataFast. Verify current pricing and capabilities before acting.

## Context

**DataFast** — Web analytics that ties revenue back to the marketing channel that produced it. It currently costs $9/mo.

The pageview half of DataFast is the same contained build as Plausible or Umami. The revenue half is where it stops being a contained effort. Attribution is only worth anything if the anonymous visitor who found your launch post on a phone is still recognisably the customer who pays from a laptop three weeks later, and that stitching is exactly what an agent will hand you a naive version of. A localStorage id plus an email match at signup does get you a channel table that is directionally right for a single-domain solo product, which is genuinely worth having. It also quietly under-counts every cross-device path, every privacy browser that clears storage between visits, and every customer who pays with a different address than they signed up with. You can build the dashboard in a contained effort. Trusting it enough to move ad spend is the part that keeps costing you weekends.

This brief describes a focused, single-operator replacement for the part of DataFast that is genuinely reproducible. It is deliberately narrower than the product it replaces, and it says so in writing. Build the useful core; do not pretend to have rebuilt the rest.

## What you are building

Record pageviews with their UTM and referrer channel, bind the anonymous visitor to a customer at signup, then take Stripe webhooks and show revenue per channel.

- Ingest a known data source, calculate a focused metric set, and render a useful dashboard.
- A responsive interface with real empty, loading, success, and error states.

## Requirements

### Functional

- Hosted server.
- Database.
- Tracker script.
- Domain/SSL.
- Bot filtering.

### Data and integrations

- Stripe webhook secret.

Each of these needs a real account, credential, or quota. Set them up before writing feature code.

### Non-functional

- Accessibility: semantic markup, labelled controls, visible focus, and reduced-motion support.
- Security: server-side secrets, validated input, and no credentials in the client bundle.
- Reliability: retries with backoff on external calls, and a clear failure state when a provider is down.
- Portability: the operator can export their data and leave without losing it.

## Implementation brief

Build me a revenue attribution dashboard for one site, to replace DataFast. Requirements:

- Node + Express + better-sqlite3, one process behind Caddy on my own VPS.
  Server-rendered pages, no frontend framework, no build step.
- A tracker snippet under 2 KB: navigator.sendBeacon sends path, referrer and
  any utm_* params, keyed to a first-party visitor id in localStorage. No
  third-party cookies.
- Attribution is the whole point. Per visitor store first-touch and last-touch
  channel, from utm_source/utm_medium/utm_campaign, else by parsing the
  referrer host into google / x / reddit / hn / direct. Never overwrite
  first-touch.
- An /identify endpoint I call after signup with the user's email, which binds
  the anonymous visitor id to a customer row.
- A Stripe webhook for checkout.session.completed, invoice.paid and
  customer.subscription.deleted: verify the signature, match on email, write
  revenue against that visitor. Webhook secret and API key from .env.
- Dashboard on localhost behind one bearer token from .env: a channel table
  with visitors, signups, customers, MRR and revenue per visitor over 7/30/90
  days. Tables and one inline SVG bar chart, nothing else.
- Drop known bots against a user-agent blocklist before anything is counted. No
  accounts, no telemetry, one SQLite file I can copy off the box.
- Out of scope: cross-device identity stitching, multi-touch models, the live
  visitor feed, purchase-likelihood scoring, team seats and an MCP server. One
  domain, single-touch, single-device.
- README: the script tag, the /identify call, `stripe listen` for testing
  webhooks locally, and an honest paragraph on where the numbers lie · a
  phone-to-laptop journey counts as two visitors, cleared localStorage counts
  as a new one, and a customer who pays from a different address never matches
  at all.

## Delivery standard

- Inspect the repository first, then write a short implementation plan before writing code.
- Deliver the smallest complete end-to-end workflow first; every primary control must work against persisted data.
- Use real validation and storage; never substitute fake dashboards, decorative controls, hard-coded success states, or mock integrations.
- Include responsive layouts plus genuine empty, loading, success, validation, and failure states.
- Keep secrets server-side in environment variables, provide .env.example, and never commit credentials or user data.
- Add structured logs around every external call and return actionable errors without leaking sensitive details.
- Write unit tests for the core logic and one automated test of the main user journey.
- Finish with a README covering setup, architecture, data location, backups, tests, deployment, and known limitations.

## Acceptance criteria

- [ ] A clean install starts the app using only the README and .env.example.
- [ ] The primary journey works from first visit through saved result, reload, edit, export, and deletion where applicable.
- [ ] Invalid input, missing configuration, provider failure, and an empty database each have a usable state.
- [ ] The interface works at 390px and 1440px, is keyboard navigable, and shows visible focus on every control.
- [ ] Tests, type checking, linting, and a production build all pass with no ignored failures.
- [ ] No part of the interface implies a live integration, security guarantee, or scale capability that was not actually built and verified.

## Non-goals

Do not build these, and do not claim to have replaced them:

- Identity stitching across devices, browsers and cleared storage.
- Bot and AI-crawler filtering that stays current without you.
- One-click installs for Shopify, Webflow, WordPress and 20 other platforms.
- The live visitor feed and purchase-likelihood scoring.
- Connectors, OAuth flows, and vendor API changes require constant upkeep.
- Reliability at the vendor's scale is an operations problem, not a prompt.

## What you still own after launch

- Run migrations, backups, restores, and dependency updates.
- Test the critical journey after every model, API, or hosting change.
- Monitor failures and fix the edge cases a first prompt will miss.
- Maintain every third-party integration as APIs and OAuth rules change.

## Risk

**Operational risk.** The code is achievable; dependable data, integrations, and ongoing operations are the real cost.

Editorial confidence in this assessment: high. No independent one-shot implementation is linked yet.

## Prior art

Working open-source software you can read, fork, or borrow from before starting:

- [PostHog](https://github.com/PostHog/posthog) — Open source and self-hostable, with revenue analytics and channel attribution already built
- [Plausible](https://github.com/plausible/analytics) — Open source analytics with goals and revenue goals; the Stripe join is still yours to write
- [Umami](https://github.com/umami-software/umami) — Lightweight self-hosted analytics with UTM tracking and no revenue side at all

---

Generated by [Can It Be Vibe Coded?](https://www.canitbevibecoded.com) · Full report: https://www.canitbevibecoded.com/datafast