Skip to content
All posts

Peeko is open. The first thing it did was lie to me.

New
6 min read

I built my own analytics to replace Google Analytics. Last week it told me Google had read a passwords file that does not exist on my site. Fixing that lie became the feature I like most, and now anyone can use it.

Peeko's AI page in dark mode, showing four requests under Googlebot for paths that hold passwords and keys
Four requests from last week, in the panel this post is about.

Last week I opened my own analytics tool to see which robots had been reading this site. One row said Google had indexed a file called .netrc. Below it, three more.

That file is where a computer keeps login details for other computers. It does not exist on my site. It never has.

Three things were wrong in that one screen, and every one of them was my fault. Fixing them is how Peeko got the feature I now like most. So this post is both things. What my tool got wrong, and what it does now that anyone can use it.

Three things wrong in one screen

It was not Google. Every visitor that arrives at a website introduces itself. A browser says it is a browser. Google's crawler says it is Google's crawler. That introduction is a line of text, written by whoever is visiting, and nothing checks it.

Something was going down a list of doors, and it had put Google's name on its coat.

The obvious fix is to record where each visitor arrives from and check it against Google's published list. I am not going to record that. Storing no visitor addresses is the reason Peeko needs no cookie banner. I would rather show you a name I cannot verify and say plainly that I cannot verify it.

"Indexed" was never knowable. A visit tells you a page was asked for. It tells you nothing about what happened next. Peeko could not know whether Google indexed anything, at any point, ever, and it said so anyway.

And a panel underneath said everything was fine. It was headed "Missing pages it wanted", and it read: none from this bot. It said that for every robot, always. Not because there were none, but because my tool cannot see them. Peeko finds out about a request. It never finds out what my site said back. So that number was never zero. It was blank, and a blank was rendering as good news.

That is the worst bug an analytics tool can have. Not a wrong number. A confident one.

A crawler's detail pane saying what it came for, that its identity is unverified, and that this site cannot report missing pages
The repair was mostly deletions. Last week these rows said "indexed". Now they say what the robot came for, and the panel that cannot see says so.

What it will and will not claim

Who is knocking. I cannot tell you who is at the door. I can tell you what they asked for, and the request itself is the one thing here I see completely. So there is a list of 57 file and folder names that on a normal site nobody has an honest reason to want: passwords and keys, code history, config and backups, login pages for software you do not run, and the handful of paths that mean somebody wants to run their own code on your server. Last week 88 requests to this site matched. One of them went looking for a file where people keep their OpenAI key.

It compares whole names, not fragments, so an article of mine about environment files never gets flagged. And every site can edit the list. Somewhere out there is a real site that genuinely serves a page named like one of these.

The Suspicious requests panel listing 88 matches including .env, .aws/credentials and .docker/.env
Seven days on this site. Nobody links to any of these.

Which robots came, and why. Last week 23 of them visited this site, and Peeko sorts each one by what it came for: training a model, answering somebody's question right now, or building a search index. Those are three different relationships with your writing, and calling them all "bots" throws away the only interesting part.

When an assistant read you to answer someone. That middle group is new in the world, and nothing else I used could see it. Last week it happened 137 times: an AI assistant fetched a page here while replying to a person. The question never touches my server, so nobody can see what was asked, only which page got read. None of this shows up in Google Analytics, and none of it counts against what you pay me either.

A journey, never a name. Every human visit gets a profile: where it came from, the pages it moved through, how long it stayed, on what device, in which country. Somebody in the United States read the same post of mine three times in one day last week. Peeko calls them Marbled Dingo. The name is invented, the reading is real, and I will never know who they are. Underneath the profile is a scrambled code that cannot be run backwards, and that resets itself on a schedule, so even I cannot follow a person for long.

A visitor profile called Marbled Dingo showing three visits to the same blog post in one day, with a note explaining the name is a one-way hash
Three reads of one post, twelve hours apart.

And the ordinary things, done plainly

None of that would matter if the basics were missing, and most of what I look at is ordinary. Views, visitors, sessions, bounce, time on the page, and whoever happens to be reading right now.

The Peeko dashboard overview in dark mode with views, visitors, a traffic curve, live visitors and a country map
Thirty days on this site, and whoever is reading it right now.

Last week 61% of the people here arrived directly and 21% came from LinkedIn. They read the homepage first, then the post about blank boxes. Two thirds were on a desktop and a third on a phone, and 35% of them had their machine set to dark mode, which is the sort of thing I will change a design over.

The pages, sources and devices breakdowns in dark mode, showing top pages, referrers, device split and appearance split
Pages, sources, devices. The boring half, and the half I check most.

It counts clicks too, and any event you care to name. On this site that is people pressing play on the narration, hearting a post, or leaving through a link to something else I built.

The clicks card in dark mode listing tracked events and the outbound links visitors clicked
Named events on the left, the links people actually left through on the right.

You can just ask it

Peeko plugs into Claude Code, so most days I do not open any of these screens. I ask.

"How many people are on the site right now?"

One person. On the chat page. From Germany.

It can do exactly seven things, and every one of them is read only. It cannot change anything, and there is nothing personal in there to leak, because nothing personal was ever collected.

If you want to look

Peeko is the tool I wrote about in I replaced Google Analytics with an analytics system I can talk to, which is the longer story of why I left. Short version: it watched people more closely than I was comfortable with, and simple questions took digging.

As of today, anyone can use it.

Installing it is one line pasted into your site. No cookies, no visitor addresses, no consent banner. $9 a month to start, and however many sites and teammates you have are included.

There is a live demo at usepeeko.com/demo with real data and no sign-up. Go look at what has been knocking on somebody else's doors.

One more thing that missing-pages list cost me. Peeko's home page used to sell it, and for most people who would buy this it will always be empty, for the same reason mine is. So I took it off the home page. I would rather write that sentence than have somebody pay me $9 and find it out in week two.

An analytics tool has one product, and it is not charts. It is your willingness to believe the number. Mine had been quietly rounding "I do not know" up to "everything is fine", which is the most expensive mistake an analytics tool can make.

It says "I do not know" now. That is the version I am comfortable charging for.

0 hearts

Get new posts by email

I write when there is something worth saying. One email per post, nothing else.

No spam. Unsubscribe in one click.

  • analytics
  • google-analytics
  • privacy
  • ai
  • build