Review collected fields
Document the pageviews, events, referrers, campaigns, and custom payloads your site sends. Do not place names, emails, credentials, or other unnecessary personal data in event fields or URLs.
Privacy
Evaluate privacy-friendly and cookie-free web analytics before deployment.
Amami documents its tracking, authorization, retention, and hosting controls so your team can review them. Compliance is not automatic: it depends on what you collect, how you configure the service, where you operate, and which laws apply.
Determine consent requirements
Cookie use is only one part of privacy review. Determine whether your tracking configuration, event data, local rules, and legal basis require consent or another disclosure.
Keep credentials out of chat
The hosted setup flow uses browser authorization and writes the MCP API key to a local configuration file. Do not paste login details or API keys into prompts, logs, or public issue reports.
Privacy review checklist
Use these questions with your privacy or legal reviewer before enabling analytics:
- Data minimization: Which fields and custom events are necessary for the stated purpose?
- Legal basis and consent: Which rules apply to each audience and deployment region?
- Retention: Does the configured plan or self-hosted policy match the documented need?
- Access: Which users and MCP clients can read or change analytics data?
- Transparency: Do your public notices accurately describe the deployed configuration?
Security model
Read-only by default
The MCP server starts in read-only mode. Write operations require explicit opt-in via --write flag or AMAMI_ENABLE_WRITE=1.
Browser-based auth
Login, registration, and API authorization all happen in your browser. Agents never handle your credentials.
Local credential storage
The setup command writes its API key to a local configuration file; protect that file and rotate exposed keys.
Document your processors
Record the services, hosting regions, retention settings, and people that process or access your deployed analytics.
Next steps
Move from product claims to deployment evidence.
1. Map data
List the standard fields, custom events, URL parameters, and imports your deployment will process.
2. Review controls
Check access, MCP scopes, retention, hosting, deletion, backup, and incident-response responsibilities.
3. Get approval
Have the appropriate privacy or legal owner approve notices, legal basis, consent behavior, and processor terms.
Review the security model before connecting a client.
See how browser authorization, local credential storage, read-only defaults, and explicit write scopes work in the current MCP setup. Then use the Google Analytics alternative guide to plan a measured migration.