What Measr is and how the pieces fit.

The three pieces

Measr ships as a repository, not a service. Everything you deploy comes from three folders:

The data flows in one direction:

Your site ──→ sdk/measr.js ──→ measr-ingest ──→ Your Supabase ──→ dashboard/
              (sends event      (edge function:    (Postgres +       (auth-gated
              batches)           validates, rate-   RLS + RPCs)       reads)
                                 limits, writes)

As of v1.3.0 the tracking script sends every event to the measr-ingest edge function in your own Supabase project, which validates and rate-limits each request and writes with server-side credentials — the current SDK uses only that endpoint. The public key itself also retains the legacy write-only grants so pre-v1.3.0 SDK copies keep working — either way it can never read, change, or delete analytics. The dashboard reads as an authenticated user. That split is the whole security model.

What makes it different

• You own the data. Everything lives in your Supabase project. Measr never sees, stores, or touches your analytics. If you stop using it, your data stays where it is.
• No cookies, no visitor storage, usually no consent banner. Nothing about your visitors is stored on their device (the single localStorage key is a developer debug toggle: read on load, written only by you while testing): sessions are counted server-side with a 30-minute idle timeout and a daily-rotating visitor key. No client-side fingerprinting, no cross-domain tracking, no directly identifying data by default. Whether your specific deployment needs a banner is a judgment for you or your counsel — see the privacy guide.
• Defined event schemas. Every one of the nine modules writes a documented event type with documented fields. No ambiguity about what a number in the dashboard means.
• Bot filtering built in. Known crawlers, headless browsers, and automation frameworks are detected before any event fires. Detection is pattern-based and best-effort — a bot imitating a real browser can evade any client-side filter.

What you need

• Node.js 22 or later (node --version to check)
• A free Supabase account (you can create it during setup)
• A website or web app where you want to add tracking
• Any static host for the dashboard: Netlify, Vercel, GitHub Pages, S3, or your own server
• About 30 minutes

Pick your setup path

Both paths produce the same install. The difference is who does the typing.

Path 1: Guided setup with an AI assistant (recommended)

The repo ships a built-in setup skill for Claude Code, plus a ready-made prompt for Cursor, Windsurf, and other assistants. The assistant checks your prerequisites, walks you through Supabase, scans your site, shows you exactly what will be tracked before writing any code, and verifies each event type at the end.

Continue with the guided setup →

Path 2: Manual setup

Seven steps you run yourself: create the Supabase project, run the migrations, add the tracking snippet, create a dashboard user, configure and build the dashboard, deploy, verify. Nothing in it requires prior Supabase experience.

Continue with the manual setup →

See it before you install it

The live demo at demo.measr.app is a real Measr dashboard reading real data. The sign-in form is pre-filled: just click Sign In and click around the eight sections.

Frequently asked