Deploy and Host Offen Fair Web Analytics on Railway

Offen Fair Web Analytics is a radically privacy-first, open-source analytics tool with a feature no other option has: your visitors can access, review, and delete the data collected about them. Collection is strictly opt-in, all usage data is end-to-end encrypted (the server literally cannot decrypt it), and no IP addresses or User-Agent strings are ever collected. This template deploys Offen with PostgreSQL and a generated operator login, running behind Railway's HTTPS — a genuinely fair, GDPR-aligned alternative to Google Analytics where transparency is the point.

What This Template Deploys

Service	Purpose
Offen	The analytics server, operator dashboard, and user Auditorium (Go binary)
PostgreSQL	Stores the end-to-end encrypted usage data and accounts

Both connect over Railway's private network. Offen serves the operator dashboard, the public consent tool, and the "Auditorium" where end users inspect their own data. A generated operator account and OFFEN_SECRET are created at setup.

About Hosting

Offen takes a stricter privacy stance than any mainstream analytics tool, and a couple of Railway-specific setup details make it deploy cleanly — both handled here.

Users can see and delete their own data — the defining feature. Every tracked visitor can open the Auditorium to review exactly what's been collected about them, with plain-language explanations, and delete it or opt out entirely at any time. No other analytics tool gives end users this access — it's the strongest possible privacy story, real transparency rather than just a claim.

End-to-end encrypted, opt-in, no IPs. Clients encrypt usage data in the browser before it's sent, so the server storing it cannot decrypt it — an accidental leak or a compromised instance exposes nothing. Collection is opt-in only, so visitors who don't consent leave no trace, and Offen never collects IP addresses or User-Agent strings — a fundamentally different posture from tools that collect everything and anonymize later.

The operator login is generated at setup — not via env vars. Offen creates your first operator account through a one-time setup step that also generates OFFEN_SECRET, rather than reading a plain admin password from the environment. This template runs that setup with populate, so a working operator account and secret exist on first deploy — check your deployment for the generated credentials to log in, then add your websites in the dashboard.

Run behind Railway's proxy, not Offen's own TLS. Offen can fetch its own Let's Encrypt certificates, but on Railway you don't want that — Railway terminates HTTPS at its edge. Set OFFEN_SERVER_REVERSEPROXY=true so Offen serves plain HTTP internally and trusts Railway's proxy for TLS, which this template configures. Encrypted usage data and accounts persist in PostgreSQL.

Lightweight and multi-site. Offen is a single Go binary — light and fast — and one installation can track multiple websites, with accounts shareable across a team. Add a small script snippet to each site to start collecting from opted-in visitors.

Typical cost: ~$5/month on Railway for the Go service and Postgres. Offen is free and open source, supported by the NLnet Foundation's Next Generation Internet initiative — it will always be free.

How It Compares

	Offen (self-hosted)	Google Analytics	Plausible	Matomo
User data access	Yes — the Auditorium	No	No	No
End-to-end encryption	Yes	No	No	No
Consent model	Opt-in only	Tracks by default	Cookieless	Configurable
IP collection	Never	Yes	No	Configurable
Data ownership	Full — your infra	Google	Vendor/self	Full
Self-hostable	Yes	No	Yes	Yes

Google Analytics tracks by default and sends data to Google. Plausible is privacy-friendly and cookieless but doesn't give end users access to their data. Matomo is powerful and configurable but heavier. Offen's edge is the fairness model — opt-in, end-to-end encrypted, no IPs, and unique user access to collected data — self-hosted, with the strongest transparency story of any analytics tool, on infrastructure you own.

Deploy in Under 5 Minutes

Click Deploy on Railway — Offen and PostgreSQL build, and setup generates your operator account (~3 minutes)
Confirm OFFEN_SECRET is set and OFFEN_SERVER_REVERSEPROXY=true
Find the generated operator email and password in your deployment
Open your Railway domain, log in to the operator dashboard, and add a website
Copy the script snippet into your site's pages to start collecting from opted-in visitors

Point visitors to the Auditorium so they can review and control their own data — the fairness feature.

Common Use Cases

Radically private analytics — opt-in, encrypted web analytics with no IPs, as a GDPR-first GA alternative
User-transparent tracking — give your visitors real access to and control over their own data
Multi-site analytics — track several websites from one installation, shared across a team
EU/GDPR compliance — a consent-first, minimal-collection tool built for European privacy norms

Configuration

Variable	Required	Description
`OFFEN_SECRET`	Generated	Base64 secret created at setup — signs and secures Offen; keep stable
`OFFEN_POSTGRES_CONNECTIONSTRING`	Auto-injected	PostgreSQL connection for encrypted data and accounts
`OFFEN_SERVER_REVERSEPROXY`	Pre-set	`true` — Railway terminates TLS, so Offen serves HTTP internally
Operator email / name	Set at setup	The generated first operator account for the dashboard
`OFFEN_APP_LOCALE`	Optional	Interface locale for the dashboard and consent tool

The operator login is generated at setup. Offen creates the account and OFFEN_SECRET via a setup step, not a plain env password — check your deployment for the generated credentials. Keep OFFEN_SECRET stable across redeploys.

Use reverse-proxy mode. Set OFFEN_SERVER_REVERSEPROXY=true so Offen trusts Railway's TLS instead of fetching its own certificates. Encrypted data persists in PostgreSQL.

Dependencies for Offen Hosting

Railway account — ~$5/month for the Go service and Postgres
PostgreSQL (included and wired for encrypted data storage)
A website where you can add the Offen script snippet
Nothing else — Offen is a single self-contained Go binary

Deployment Dependencies

Implementation Details

The template runs the official offen/offen image — a single Go binary serving the operator dashboard, the opt-in consent tool, and the user-facing Auditorium — alongside a Railway PostgreSQL service on the private network. Offen's defining model is privacy: usage data is end-to-end encrypted in the browser before transmission so the server cannot decrypt it, collection is strictly opt-in, no IPs or User-Agent strings are collected, and every tracked user can review and delete their own data through the Auditorium.

The operator account is created through Offen's one-time setup command with the populate flag, which generates the OFFEN_SECRET and the first login rather than reading a plain admin password from the environment; the template runs this so a working account and secret exist on first deploy. Because Railway terminates TLS at its edge, OFFEN_SERVER_REVERSEPROXY=true is set so Offen serves plain HTTP internally and does not attempt to acquire its own Let's Encrypt certificates.

One Offen installation can track multiple websites with accounts shared across a team, integrated by adding a lightweight script snippet to each site. Encrypted usage data and account information persist in PostgreSQL, which is the component to back up. OFFEN_SECRET must remain stable across redeploys.

Frequently Asked Questions

What makes Offen different from Plausible or Umami? Offen lets your end users access, review, and delete the data collected about them — no other analytics tool does this. It's also end-to-end encrypted, opt-in only, and never collects IPs, making it the most transparent option.

Where do I find my operator login? It's generated by Offen's setup step, not set as a plain env variable. Check your deployment for the generated operator email and password, then log in to the dashboard.

Is the data really encrypted? Yes — clients encrypt usage data in the browser before sending it, and the server cannot decrypt it. Even a compromised instance or accidental leak exposes nothing readable.

Do I need a consent banner? Offen is opt-in by design and includes a consent tool; visitors who don't opt in leave no trace at all, which is stricter than cookieless-but-default tracking.

Can I track multiple websites? Yes — one installation handles multiple sites, and accounts can be shared across a team, each site integrated with its own script snippet.

Why Deploy Offen on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Offen on Railway you get the most transparent analytics tool available with the setup handled — PostgreSQL wired, the operator account and secret generated, reverse-proxy mode set, and automatic HTTPS. Opt-in, end-to-end-encrypted analytics where your users control their own data, self-hosted on infrastructure you own.