Sharing

Shared links

A shared link opens one site’s dashboard, read only, without signing in. Create one in Settings, Shared dashboard. You can protect it with a password of at least six characters and give it an expiry in days. The password is stored as a hash and cannot be shown again.

• Switching sharing off stops every link for the site at once. Switching it back on brings them back.
• Generate a new link to retire the old one.
• Wrong passwords are limited, so a link cannot be guessed open.
• On Agency, the link carries your white label brand.

Shared links come with every paid plan.

Read API

Read your reports as JSON. Create a token on your Account page and send it with every request. A token sees the same sites you do and cannot change anything. The Read API is part of Agency.

Authorization: Bearer cdk_your_token

Endpoints

Every call takes range: today, yesterday, 7d, 30d, 90d, 12mo or all. Or send from and to as dates, like from=2026-09-01&to=2026-09-10. The default is the last 30 days.

curl -H "Authorization: Bearer cdk_your_token" \
  "https://analytics.convertnow.tools/api/v1/sites/1/summary?range=30d"

Sending data from your server

Two write endpoints take the site’s server token from Settings, Advanced, as a Bearer header or as X-CD-Token: POST /api/sites/{id}/orders for orders a browser never sees (see Revenue) and POST /api/sites/{id}/machines for crawler requests (see Counting machines). The server token is not a Read API token and cannot read reports.

Errors

Errors come back as {"error": "..."}.

Privacy

Privacy and what is stored

ConvertDash is built so the analytics do not need a consent banner in most places. Check your own rules; this is what the software does.

What a self hosted install sends us

Two check ins, both described field by field in docs/licensing.md, which ships with the install. The licence check in, once a week while a key is active, sends the key, a random install id, the domains you track, how many sites, the versions of ConvertDash, PHP and the database, and a rough pageview band. The product check in, which is asked for at install and off until you say yes, sends the same facts without a key and with the monthly pageview count. No row of your analytics, no path, no referrer and no visitor is in either. php bin/convertdash checkin off stops the product check in and deletes what was sent.

Troubleshooting

Start with the two buttons on Sites and tags. Check installation reads your page and names the problem. Test from my browser sends one visit from your own browser and shows whether it got through, and if not, why.

No tag found

The tag is not in the page the dashboard fetched. Check that it is inside <head> and on the live site, not only in a draft or a staging copy. If you just added it, clear your site’s cache, because the old page may still be served.

Caching and optimisation plugins

LiteSpeed Cache, WP Rocket, SiteGround Optimizer and Cloudflare Rocket Loader can delay or combine scripts. The attributes on the tag ask them not to. If one still delays it, add cd.js to that plugin’s list of scripts to leave alone (in LiteSpeed Cache: Page Optimization, JS Delayed Includes Excludes; in WP Rocket: File Optimization, Excluded JavaScript Files). Then clear the cache.

Cloudflare

If your site sits behind Cloudflare, the tag is not affected: it carries data-cfasync="false" so Rocket Loader leaves it alone, and each visit is a POST that no cache stores. Pages served from Cloudflare’s cache still run the tag in every browser, so every visit is counted. If numbers look low and nothing in Filtered Traffic explains it, check that Bot Fight Mode is not challenging requests to the analytics host.

Ad blockers and Brave

Some blockers stop analytics requests, and those visits cannot be counted. Brave also sends Global Privacy Control with every request, which ConvertDash honours by default. To test your own install, use a regular Chrome or Safari window.

Do Not Track

Browsers sending Do Not Track or Global Privacy Control are skipped by default. If your own test visit does not appear, this is often why. You can switch it off in Settings.

VPN

iCloud Private Relay visitors are always counted. VPN visitors who interact are counted too. A VPN visitor who never touches the page can look like data centre traffic and be refused. If many of your readers use a VPN, switch off the data centre filter in Settings.

Wrong domain

Visits from a domain the site is not registered under are refused. If your site also answers on another domain, add it under Settings, Advanced, Extra allowed domains.

Content Security Policy

If your site sends a Content Security Policy, it must allow the tag to load and to send visits. Add the analytics address to script-src and connect-src:

script-src 'self' https://analytics.convertnow.tools;
connect-src 'self' https://analytics.convertnow.tools;

My numbers are lower than another tool

Expected. See What counts as a visit, then open Filtered Traffic: the difference is listed there by name.

Your own server

Self hosting

ConvertDash runs on your own server as well as ours. It is the same code, the same tag and the same 60+ reports. The code is public at github.com/prateekzare/convertdash. The key you buy for Pro Single, Pro Power or Agency works here as well as on the hosted service. Or buy the Lifetime licence with one payment. Self hosted has no pageview limit, on any plan.

Requirements

Docker quick start

git clone https://github.com/prateekzare/convertdash.git
cd convertdash
cp .env.example .env

Set two things in .env:

CD_DB_PASS=something long and random
CD_PUBLIC_URL=https://analytics.example.com

CD_PUBLIC_URL is the address a browser uses to reach this install. It goes into every tag, so if it is wrong the tag points nowhere. Then start it:

docker compose up -d

The first start takes about forty seconds while the database sets itself up. Open your address (or http://localhost:8080 on your own machine), fill in one form, and you have an account, a site and a tag. Four containers run: web (nginx), app (PHP), worker (rollups, retention and the licence check in) and db, which has no published port.

Prefer a ready image to building one? Each release is published as ghcr.io/prateekzare/convertdash with its version as the tag.

Without Docker: a VPS or shared hosting

Upload the code (the release zip from GitHub, or git clone), create an empty database, and fill in CD_DB_* and CD_PUBLIC_URL in .env. Then, over SSH:

cp .env.example .env
php bin/convertdash install [email protected] --password='a long password' --domain=example.com
php bin/convertdash doctor

Point the domain’s document root at the public/ folder. Nothing above it may be reachable from the web. On Apache and LiteSpeed the shipped public/.htaccess already has the rules. On nginx:

server {
    server_name analytics.example.com;
    root /srv/convertdash/public;

    location / { try_files $uri /index.php$is_args$args; }

    location ~ ^/index\.php$ {
        include fastcgi_params;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root/index.php;
    }

    location ~ \.php$ { return 404; }
}

Add two cron lines. On shared hosting (Hostinger, cPanel and similar) they go in the panel’s cron screen, with the full path to your folder:

*/5 * * * * php /srv/convertdash/bin/convertdash worker >/dev/null 2>&1
* * * * * php /srv/convertdash/bin/convertdash tick >/dev/null 2>&1

The first runs rollups, retention, digests and the licence check in. The second writes waiting pageviews to the database within a minute on a quiet site. Shared hosting needs no Redis and no Docker: pageviews are queued in a file on disk.

Reverse proxy and HTTPS

ConvertDash speaks plain HTTP and expects something in front of it to handle HTTPS. Caddy is the shortest way, and fetches the certificate by itself:

analytics.example.com {
    reverse_proxy localhost:8080
}

With nginx in front, pass the address along:

location / {
    proxy_pass http://127.0.0.1:8080;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

Then tell ConvertDash which proxies to believe, or anybody could fake their address past the rate limits:

CD_TRUSTED_PROXIES=127.0.0.1
# behind Cloudflare, its published ranges are expanded for you:
# CD_TRUSTED_PROXIES=cloudflare,127.0.0.1

Do not add a cache rule for the analytics address in Cloudflare or any CDN. ConvertDash marks every dynamic answer no-store, and a cache that ignores that changes your numbers.

Activating your licence

In the dashboard, open Settings, Licence. Paste the key and press Activate. The screen shows the plan, how many of its installs are in use, when the next check in is due, whether an update is available, and a Deactivate button. From the command line:

php bin/convertdash license activate --key=CD-XXXXX-XXXXX-XXXXX-XXXXX
php bin/convertdash license status
php bin/convertdash license check
php bin/convertdash license deactivate

With Docker, put docker compose exec app in front of each. One message you may see:

• All servers are in use. A yearly key covers 1, 2 or 5 servers (Pro Single, Pro Power, Agency) and Lifetime covers 2. Run license deactivate on the server you no longer use, or release it from the email the lost key form on the product page sends you.

The install checks in once a week, and verifies the licence against a signature it already holds, so it keeps working when it cannot reach us. A Lifetime licence never expires. A yearly licence runs to the end of the year you paid for, and when it lapses without renewal the install moves to the free rules after a short grace period. A refunded key steps down the same way. Collection never stops and there is never a pageview limit.

Updating

Settings, Licence says when a newer version is out. With Docker:

git pull
docker compose build
docker compose up -d

The app applies database changes when it starts. Without Docker, replace the code but keep .env and storage/, then run:

php bin/convertdash ingest:flush
php bin/convertdash migrate
php bin/convertdash doctor

Release notes are on GitHub releases. Take a backup first.

Backups

Everything that matters is in the database plus your .env file. With Docker:

docker compose exec -T db sh -c 'mysqldump -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE"' | gzip > convertdash-backup.sql.gz

Without Docker, mysqldump the database the usual way, or use your host’s backup tool. Keep .env with the dump. CD_APP_KEY in it salts every visitor hash, so restoring with a different key breaks visitor continuity at that point.

Moving to another server

1. Run php bin/convertdash license deactivate on the old server. That frees one of the two installs.
2. Copy the database dump and .env to the new server.
3. Restore the dump and start ConvertDash there, as above.
4. Run php bin/convertdash license activate --key=... on the new server, and point your DNS at it.

Old server already gone? Use the lost key form on the product page. The email lists your installs and lets you release one. Or write to us and we release it.

Scaling up

One box with Docker handles a busy site. When you need more:

• Run several web containers behind a load balancer. Set CD_SESSION_DRIVER=db so a sign in works on every one of them, and share the storage volume between them.
• Run as many worker containers as you like. Scheduled work takes a database lock first, so only one of them does each job.
• /healthz and /readyz answer load balancers and orchestrators. The Docker image reports its own health too.
• The repository has a ready Compose file for this: deploy/compose/docker-compose.scale.yml.

The scaling guide has the settings, a measured benchmark and a sizing guide. A Redis queue and Kubernetes manifests are on the list for later releases.

Uninstalling

Deactivate the licence first, so the install is free for somewhere else:

php bin/convertdash license deactivate

With Docker, docker compose down stops everything and keeps your data. docker compose down -v also deletes the database volume, and that cannot be undone, so take a backup first. Without Docker, remove the two cron lines, drop the database and delete the folder. Then take the tag off your sites.

Plans and billing

Every new hosted account starts with a seven day free trial. It includes everything a paid single site gets, plus All sites. No card, nothing to cancel. After seven days the account moves to the free plan and keeps collecting. Prices are on the pricing section of the product page, in your currency.

The core reports on the free plan are pages, referrers, campaigns, geographic, devices and filtered traffic. The trial has the Pro Single column plus All sites, with 100k pageviews.

Pageviews are a soft allowance, and only on the hosted service. Go over and nothing stops counting. We email you at 80 and 100 percent of the month’s allowance and suggest the next size. On your own server there is no pageview limit at all, with the same key.

Accounts and servers

One yearly key works in as many hosted ConvertDash accounts as the plan allows (one for Pro Single, two for Pro Power, five for Agency), and on the same number of your own servers. The two are counted separately. Removing the key from an account or a server frees its place for another. Lifetime works on two of your servers, such as production and staging. See moving to another server.

Refunds

Fourteen days, no questions, on every plan including Lifetime: email us. A full refund retires the licence. A hosted account moves to the free plan; a self hosted install moves to the free rules. Nothing you collected is deleted either way. A partial refund is reviewed by a person before anything changes.

Upgrading

Open Subscription in your dashboard and pick a plan. The plan applies to your account the moment the payment clears. Confirm your email address first: the plan cards show before that, but the payment step does not. An upgraded key keeps working in both places, for the difference in price. A Lifetime licence already has everything, so there is nothing to upgrade.

Licence keys

Plans bought on the product page come as a licence key by email. For a hosted plan, paste it under Subscription, Licence key, and the plan applies straight away. Removing the key there takes the account back to free and frees the key for another account. It does not cancel a yearly renewal: do that from the Razorpay receipt in your email, or reply to it. For a self hosted key, yearly or Lifetime, see activating your licence.

Already have a hosted key and need more sites? The upgrade form on the product page charges the difference between the two plans, once. Your key and renewal date stay the same.

Currencies and VAT. Prices are shown in US dollars unless your time zone or language points to another currency, and the list above the plans switches it. Nothing is stored in your browser to remember the choice. Rupees are charged through Razorpay, every other currency through Stripe, and you pay exactly the price shown. Where VAT applies it is already inside that price. A business in the EU outside Germany can enter its VAT number at checkout and is reverse charged.

Paying through Cashfree. Where the price list says Cashfree, you enter your email and phone number on the product page (Cashfree needs both), pay on Cashfree’s own page and come straight back to your key. Cashfree sells twelve months as one payment. Before it runs out we email you a link to renew for another year.

Referral programme

Anyone can join, customer or not. You get a link and a code, and you earn 10% of what the people you send pay us.

1. Join. Enter your name and email in the referral section of the product page. We email your link, your code and a private link to your earnings.
2. Share. Your link looks like https://convertnow.tools/convertdash/?ref=YOURCODE. A buyer can also type the code under “Have a referral code?” next to the plans. Signing up for the hosted service through analytics.convertnow.tools/signup?ref=YOURCODE keeps the code on the account for when they buy.
3. Earn. 10% of every payment they make: the first purchase, renewals, upgrades and Lifetime, in the currency they paid in, without any tax the payment provider reports.

A commission is pending for 14 days, the refund window. Then it is approved, and paid once we send it, with an email each time. A refunded payment voids its commission. Your own purchases earn nothing. Buyers never see who referred them, and you never see their address.

The earnings link in your email lasts 30 days. To get a fresh one, use “Already joined?” in the same section.

The licence, in full

Written out because a licence you have to email somebody about is a licence nobody reads. Everything below is how the software behaves. The plan table it refers to is on the pricing section of the product page.

1. The first seven days

Every new hosted account gets the Pro Single column plus All sites for seven days. Team, White label and the Read API stay on Agency. No card is asked for and there is nothing to cancel. On the eighth day the account moves to the Free column and keeps collecting.

History older than 30 days is hidden rather than removed, and each locked report names the plan that opens it. The free plan keeps 90 days of detail, so pay within three months and the older data is visible again at once, including the weeks you spent on the free plan.

2. What a key attaches to: accounts and servers

A Pro Single, Pro Power or Agency key works in two places at once, and each is counted on its own.

On the hosted service it attaches to accounts on analytics.convertnow.tools. Buy inside the dashboard and the plan applies the moment the payment clears. Buy on the product page and you paste the key under Subscription once. The plan says how many accounts one key may sit in: one, two or five. Remove the key from an account and its place is free for another.

On your own servers it attaches to installs: your own servers, each identified by a random id it creates on first run. A yearly key allows one, two or five at once (Pro Single, Pro Power, Agency), and a Lifetime key two, usually production and staging. There is no pageview limit on any of them. An install is a server, not a site, so one install can track as many sites as you like. Moving? Run php bin/convertdash license deactivate on the old server first and the place frees at once. Old server already gone? Release it from the email the lost key form sends, or write to us.

A Lifetime key works on your own servers only. The hosted service refuses it with a message that says so.

3. Where the visitor data lives

Hosted: your readers’ requests reach our servers, and what the collector keeps is written there: a visitor identifier that rotates daily by default, the page, the referrer, the country, the device and similar facts. IP addresses are never stored. We show you your own reports and do nothing else with it: no selling, no ad networks, no data brokers, no profiles of your readers or of you. You can export it and you can ask us to delete it, and deletion means deletion.

Self hosted: it is written to your own database and stays there. None of it is sent to us.

4. The check in, and exactly what it sends (self hosted)

Two check ins exist. A licence check in happens when you activate a key and then once a week. A product check in, which the installer asks about and which is off until you say yes, happens once a month so we know how many installs exist and which versions to keep supporting.

What they send: the random install id, the address you configured, the domains you track, how many sites there are, the ConvertDash, PHP and database versions, the platform, and the number of pageviews recorded in the last thirty days. One number. The licence check in also sends your key, because that is what it is for.

What they never send: any row of traffic, any visitor, any page path, any referrer, any figure from any dashboard, any email address, any account.

php bin/convertdash checkin off stops the product check in and deletes the record of your install on our side. See the exact message with php bin/convertdash checkin preview, and read src/License/ in the source.

5. If our server is unreachable, nothing happens (self hosted)

Installs sit behind firewalls and on closed networks, where an outbound call fails for reasons nobody can fix from here. The entitlement is stored on your server and verified against a public key that ships with the install, so an install that cannot reach us keeps every feature it paid for. A Lifetime licence never expires. A yearly licence runs to the end of its year.

A yearly licence that lapses, or any licence that is refunded or revoked, steps down after a grace period. Collection continues at full speed, every row stays where it is, and the dashboard keeps working under the free rules, with no history limit on your own server.

6. Your data is never held hostage

If a plan expires, is refunded, or you stop paying, collection carries on and the dashboard keeps working. You lose the paid features in the table above and nothing else. There is no kill switch in this product.

Self hosted, the rows are in your database and stay there. Hosted, the free plan shows the last 30 days and older rows are hidden rather than deleted. Pay again and they are back the same minute.

7. How your key is stored, and how you get it back

Not in plain text. We keep a keyed hash of it plus the first eight and last four characters, so a database breach here does not hand anybody a working key for every customer. The honest trade: we cannot look your key up.

Recovery is two steps. Type the address you bought with, and that mailbox gets a list of its licences by hint, each with a link that lasts an hour and works once. The link opens a page with one button. Press it and a new key is issued, shown once and emailed. Only then does the old key stop. Nobody who merely knows your email address can take your key away.

8. What we are honest about

The code is public and readable. Anybody determined enough can remove the licence check, and no amount of cleverness would change that. So the licence is not a lock. It is a signed statement of what your install is entitled to, which cannot be forged without our private key, and it lets us count installs.

What carries the commercial weight lives on our side: the crawler signature feed a licensed install pulls, the updates, and hosted delivery. That is why there is no obfuscation in this product.

9. Renewals, cancelling and refunds

Yearly subscription: renews itself through Razorpay. A renewal moves the expiry to the end of the period it paid for, plus seven days of grace, so a card that declines and is retried does not drop you to free in between. Cancel any time by emailing us, or from the link in your renewal receipt. A licence paid until December runs until December.

One payment for 12 months (Razorpay when offered, and always at Cashfree): no auto renew, no surprise charge. We email before it lapses with a link to renew. If a yearly key lapses, a hosted account moves to the free plan and a self hosted install to the free rules, after the grace period. Both keep collecting and keep every row.

Lifetime (self hosted): one payment. It never renews and never expires, and every future update is included.

Refunds: fourteen days, no questions asked, on every plan. Email and it is done. A full refund revokes the licence and the account or install moves to free, with your collected data untouched. A partial refund changes nothing by itself: it is written on the licence and reviewed by a person, because a partial refund is usually a price adjustment, not a cancellation.

10. What you may and may not do

You may: run it on client sites, modify the source for your own use, and keep running the last version you had if you stop paying.

You may not: redistribute or resell ConvertDash itself, share a key across more accounts or installs than the licence covers, or offer it as a hosted analytics service to third parties without talking to us first. That last one is a conversation, not a no.