What did Bot2Bot Labs measure for Git history (build timeline, not hours)?

Git history (build timeline, not hours): 16 commits, all authored "Claude" with an Opus 5.5 co-author trailer, from 2026-10-23 1:05 PM PT to 2026-10-26 5:07 AM PT. The first commit alone adds 10,212 lines across 49 files, so earlier work is not visible.. Source (2026-10-26): https://github.com/surendrapandar/minilytics/commits/main

What did Bot2Bot Labs measure for Setup from README?

Setup from README: Pass on Node 22.20.0 (install 9.5 s, migrate 3.4 s, build 6.4 s, local worker ready ~3 s). README says Node 20+, but Wrangler 4.152 refused Node 20.19.2.. Source (2026-10-26): https://github.com/surendrapandar/minilytics/blob/6f71720fa8ca996382d9d6e279161101e0f68ba1/README.md

What did it cost to build Minilytics?

Build cost on price date 2026-10-26: Not disclosed human hours, Not disclosed estimated token dollars, billed not disclosed. Source (2026-10-26): https://github.com/surendrapandar/minilytics

BOT2BOT LABS

Quick receipt

$0.00/mo vs $9.00/mo (DataFast Starter, 10k events/mo, 1 website)

Minilytics, the AI-built DataFast alternative: what it costs to self-host

Item: Minilytics
Author: Bot2Bot Labs

Price date: 2026-10-26Partially Verified

Minilytics is an AI-built alternative to DataFast. Quick receipt: Minilytics (MIT, open-source DataFast-style revenue analytics by @surendra_pandar, built with Claude/Opus 5.5) vs DataFast. Local only: we cloned commit 6f71720, followed the README on Node 22, ran the builder's tests, our 20-step core flow, a 350-event concurrent burst counted in local D1, npm audit, gitleaks and passive header/session checks on localhost. DataFast compared from its public pages only.

On price date 2026-10-26, running the clone yourself is about $0.00 per month (estimate (cited Cloudflare list prices; app, tests, burst and security measured locally; no Cloudflare deploy)) versus $9.00/mo (DataFast Starter, 10k events/mo, 1 website) for DataFast. Free from day one at 1 site and 10k events/mo: $0/mo self-host vs $9/mo DataFast Starter (monthly), before your setup and upkeep time. At 100 sites the clone needs Workers Paid ($5/mo).

Verdict: good for Indie founders with a few sites who want DataFast-style revenue attribution (referrer → payment) on their own Cloudflare account for $0 and can wire payments through the API or Dodo. Skip if You need native Stripe/Shopify, team members, an analytics API or MCP, mobile apps, cookieless mode, imports, or a vendor that handles security for you. Main risk: Three-day-old, single-maintainer project with one production critical (path looks unused), no security headers and non-revocable 30-day sessions; real Cloudflare behavior not tested by us..

Quick receipt

r-0005 · Published 2026-10-26 · Price date 2026-10-26

Quick receipt: Minilytics (MIT, open-source DataFast-style revenue analytics by @surendra_pandar, built with Claude/Opus 5.5) vs DataFast. Local only: we cloned commit 6f71720, followed the README on Node 22, ran the builder's tests, our 20-step core flow, a 350-event concurrent burst counted in local D1, npm audit, gitleaks and passive header/session checks on localhost. DataFast compared from its public pages only.

Break-even

Free from day one for 1 website at 10k events/mo

$0/mo self-host (Cloudflare free plan) vs $9/mo DataFast Starter monthly. 10 sites: $0 vs $39 (Growth 100k). 100 sites: $5 vs ~$295. Excludes your setup and upkeep hours. The hosted Minilytics lifetime deal ($29 once) equals ~3.2 months of DataFast Starter.

Verdict

Good for: Indie founders with a few sites who want DataFast-style revenue attribution (referrer → payment) on their own Cloudflare account for $0 and can wire payments through the API or Dodo.

Skip if: You need native Stripe/Shopify, team members, an analytics API or MCP, mobile apps, cookieless mode, imports, or a vendor that handles security for you.

Main risk: Three-day-old, single-maintainer project with one production critical (path looks unused), no security headers and non-revocable 30-day sessions; real Cloudflare behavior not tested by us.

Confidence — 50% measured by us

measured 10/20 · builder-stated 6 · unverified 4 — Counts from claims[] types (estimates counted as unverified). Measured 2026-10-26 on our local copy; published 2026-10-26.

No upfront license fee; break-even month 0 on listed infra.

Labor-adjusted operator TCO @1 user (year 1): $0.00 — Same as tco_year_1 until hours measured.

Self-host run cost (Cloudflare free plan) vs DataFast Starter for 1 website at 10k events/mo

Estimate: 1 site × 10k events/mo fits Cloudflare's free Workers (100,000 requests/day) and D1 (100,000 rows written/day, 5 GB) limits. Cloudflare pricing pages read 2026-10-26. Not a live Cloudflare deploy: measured on a local Workers runtime with local D1.

DataFast Starter, 10k monthly events, 1 website, paying monthly ($9/mo; $90/yr paying yearly). https://datafa.st/ pricing section read 2026-10-26.

estimate (cited Cloudflare list prices; app, tests, burst and security measured locally; no Cloudflare deploy)

Two-sided receipt

A · Operator receipt

Builder or operator running the software

Build — tokens est. vs billed: Not disclosed / Not disclosed(Not disclosed)
Build — human hours: Not disclosed(Not disclosed)
Run @ 1 user / mo: $0.00/mohost $0.00 + DB $0.00 + email $0.00 + APIs $0.00 + tokens $0.00(Estimate)
Run @ 10 users / mo: $0.00/mohost $0.00 + DB $0.00 + email $0.00 + APIs $0.00 + tokens $0.00(Estimate)
Run @ 100 users / mo: $5.00/mohost $5.00 + DB $0.00 + email $0.00 + APIs $0.00 + tokens $0.00(Estimate)
Maintenance h / mo (@ 1 / 10 / 100): Not measured · Not measured · Not measured(Not measured (quick))
TCO year 1 (@ 1 / 10 / 100 users): $0.00 · $0.00 · $60.00(Estimate)
Labor-adjusted TCO year 1 (@ 1 / 10 / 100): $0.00 · $0.00 · $60.00(Not measured on this quick receipt)

Builder published no hours or token $ (says one prompt; prompt not published). Git: 16 commits over ~2.7 days (a timeline, not hours). If you self-host, your build cost is $0: you clone it.
1 site × 10k events/mo ≈ 333 events/day. Cloudflare Workers Free 100,000 requests/day; D1 Free 100,000 rows written/day and 5 GB (≈3.3k rows/day at the builder's ~10 rows per pageview). $0. Map tiles from OpenFreeMap, free, no key.
10 sites × 10k = 100k events/mo ≈ 3.3k requests/day and ≈33k D1 rows written/day: inside the free plan. $0.
100 sites × 10k = 1M events/mo ≈ 33k requests/day (free limit OK) but ≈333k D1 rows written/day, over the 100k/day free limit. Workers Paid $5/mo includes 10M requests and 50M D1 rows written per month (we need ≈1M and ≈10M). $5.
12 × $0/mo; excludes your time and a domain
12 × $0/mo; excludes your time and a domain
12 × $5/mo; excludes your time and a domain

B · User receipt

Someone using the product vs the commercial alternative

Clone price: free self host (MIT) or hosted lifetime deal — $0.00/mo(builder-stated (repo README and minilytics.app, read 2026-10-26))
Real product @ 1 / 10 / 100 tiers / mo: $9.00 · $39.00 · $295.00(measured)
Price date: 2026-10-26
Switching effort: Swap one script tag (Minilytics uses its own script and /api/event). No import from DataFast or Plausible, so history starts fresh. Revenue needs the payments API or a Dodo webhook (no native Stripe yet). README setup ~10 minutes with a Cloudflare account; our local steps ran in under 30 s.(partially verified)
Risk — reliability: Core flow and burst passed locally; real Cloudflare not tested. Brand-new project (3 days of commits).
Risk — security: Production critical in maplibre-gl (path looks unused); no security headers; sessions can't be revoked before 30 days; example secret not refused. DataFast publishes no SOC 2 either.
Risk — support: Single maintainer; builder says he will maintain it. 4 open PRs, 1 issue.
Risk — data export: Your data sits in your D1; `wrangler d1 export` dumps it as SQL (we tested locally). No in-app CSV export.
Risk — legal: MIT: self-host, modify and resell allowed. README sponsor badge and hosted lifetime deal are the builder's paid offers.

Self-host free on your own Cloudflare account. Hosted version: $29 one-time lifetime deal, 5 spots (4 left on 2026-10-26), then $49.
Growth caps at 30 websites, so no single listed plan covers 100. Cheapest combination from list prices: 5 Growth 200k accounts (20 sites × 10k each) × $59/mo = $295/mo. If each of 100 owners buys Starter: 100 × $9 = $900/mo.
List price source: https://datafa.st/

Scan results

Scan date 2026-10-26

Reliability

Core flow: 19/19 tests passed

pass at 200 concurrent (350/350 events stored in local D1; p95 559 ms); builder tests 18/18 vitest, 51/51 smoke, 24/24 hosted smoke

Setup from README: Pass

Security audit

3 critical · 1 high

npm audit on our local clone at commit 6f71720, all dependencies (production only: 1 critical, maplibre-gl, 0 high); gitleaks, headers and session checks on localhost only; DataFast via its public pages only.

Feature parity

10 of 29 checklist features(source)

Vendor certifications

DataFast: no SOC 2 or ISO 27001 claim found on its public homepage, privacy policy, DPA or terms (checked 2026-10-26; /security returns 404)(unverified)

Maintenance pulse

Measured 2026-10-26

Last commit: 2026-10-26T12:07:35Z
Open issues: 5
Contributors: 1
License: MIT
Stars: 585

Source: https://api.github.com/repos/surendrapandar/minilytics

Data & lock-in

Self-host: your own Cloudflare D1 database. DataFast: its infrastructure (AWS, Vercel, MongoDB, Tinybird, ClickHouse and others per its DPA).

Export: yes — wrangler d1 export (SQL dump of all tables); tested locally. No in-app export.

Feature parity detail

Checklist row-by-row (Minilytics vs DataFast).

Feature	Minilytics	DataFast	Matched
Web analytics: visitors, pageviews, bounce rate, session time	Yes	Starter	Yes
Revenue attribution by channel / referrer	Yes	Starter	Yes
Revenue per visitor and conversion rate	Yes	Starter	Yes
Custom goals	Yes	Starter	Yes
Funnels	Yes	Starter	Yes
Visitor journeys (first visit to payment)	Yes	Starter	Yes
Real-time visitors (live view)	Yes	Starter	Yes
Payment API (server-side revenue)	Yes	Starter	Yes
Multiple websites	YesUnlimited sites, one login	Growth (30 websites)	Yes
Subdomain tracking	YesShared first-party cookie across subdomains	Starter	Yes
Data retention 3 / 5+ years	NoPartial: keeps everything until your D1 storage limit (5 GB free); no retention guarantee	Starter 3 yr / Growth 5+ yr	No
X (Twitter) link attribution	NoPartial: shows t.co / X as a referrer with revenue; not per-post	Starter	No
Live 'likely to buy' visitor scoring	No	Starter	No
Native Stripe integration	NoOpen PR #5, not merged	Starter	No
Native LemonSqueezy / Polar / Shopify	NoDodo Payments webhook instead	Starter	No
Team members	NoOne shared admin password	Starter 1 / Growth 30	No
Analytics read API	NoWrite APIs only (payments, goals); dashboard data needs the login cookie	Starter	No
CLI	No	Starter	No
MCP server for AI agents	No	Starter	No
AI bot request tracking	NoBots are dropped, not counted	Starter (100K AI bot requests)	No
Social media mentions (X + Reddit)	No	Growth	No
Cookieless tracking script	NoUses first-party cookies	Starter	No
Cross-domain tracking	No	Starter	No
Import from Plausible	No	Starter	No
Google Search Console keywords	Noutm_term only	Starter	No
Platform plugins (WordPress, Shopify, Webflow...)	NoScript tag only	Starter	No
npm package / framework guides	No	Starter	No
React Native / Expo SDK	No	Starter	No
iOS and Android app	No	Starter	No

Price history

Receipts are re-priced at least every 90 days; append rows, do not overwrite.

Checked	Product	Price	Source
2026-10-26	DataFast Starter, 10k events/mo, 1 website (monthly billing)	$9 USD/mo	link
2026-10-26	DataFast Starter, 10k events/mo (yearly billing)	$90 USD/yr	link
2026-10-26	DataFast Growth, 10k events/mo, 30 websites (monthly billing)	$19 USD/mo	link
2026-10-26	DataFast Growth, 100k events/mo, 30 websites (monthly billing)	$39 USD/mo	link
2026-10-26	DataFast Growth, 200k events/mo, 30 websites (monthly billing)	$59 USD/mo	link
2026-10-26	Cloudflare Workers Paid (includes 10M requests/mo; D1 50M rows written/mo)	$5 USD/mo	link
2026-10-26	Minilytics hosted lifetime deal (5 spots)	$29 USD one-time	link
2026-10-26	Minilytics README sponsor slot (early price)	$19 USD/mo	link

Breakage log ongoing (local): 2026-10-26 to 2026-11-09Local daily re-test of the same commit through 2026-11-09 (no public deploy): upstream commit check, vitest, build, builder smoke, our core flow, npm audit. New breakage is appended with dates; price_date stays 2026-10-26.

AI ReceiptPartially Verified

TaskQuick receipt: Minilytics (MIT, open-source DataFast-style revenue analytics by @surendra_pandar, built with Claude/Opus 5.5) vs DataFast. Local only: we cloned commit 6f71720, followed the README on Node 22, ran the builder's tests, our 20-step core flow, a 350-event concurrent burst counted in local D1, npm audit, gitleaks and passive header/session checks on localhost. DataFast compared from its public pages only.

Tool + modelClaude (builder's build; commits authored "Claude" with Opus 5.5 trailers) · Opus 5.5 (from git commit trailers) · Not disclosed

Human hoursNot disclosed

Token $ est vs billedNot disclosed / Not disclosed

Run $/mo$0.00 tokens + $0.00 hosting

Broke1 entry(ies)

Dated2026-10-26

Not disclosed. Git shows 16 commits between 2026-10-23 1:05 PM PT and 2026-10-26 5:07 AM PT; the first commit adds 10,212 lines, so hours cannot be read from git.

Builder-stated vs measured

Type	Claim	Value	Source
Builder-stated	Builder: DataFast for free, deploy in 2 minutes at $0	"Introducing Datafast (But for free) ... It's open-source, so you can deploy in 2 minutes (at $0 cost)" (194,629 views when we read it on 2026-10-26). The README itself says about 10 minutes.	Link · 2026-10-24
Builder-stated	Builder: built from one prompt	"If you don't want to pay $29, I have the prompt to build this entire thing by yourself in just 1 prompt (and hosting for free)". The prompt was not published with the repo.	Link · 2026-10-24
Builder-stated	Builder: runs on Cloudflare's free plan	README: free plan covers 100,000 Worker requests/day (about 100k tracked events/day) and 100,000 D1 rows written/day (about 10k pageviews/day), i.e. ~10 rows written per pageview.	Link · 2026-10-26
Builder-stated	Builder: paid sponsor slots	README badge "Become a sponsor: $19/month early price" (Dodo Payments checkout); X post: max 3 sponsors at $19/month, then the price goes up. Builder posted a first sponsor on 2026-10-26.	Link · 2026-10-25
Builder-stated	Builder: hosted lifetime deal	minilytics.app public plan endpoint on 2026-10-26: hosted version $29 lifetime, 5 spots, 4 left, next price $49 (billing via Dodo Payments).	Link · 2026-10-26
Measured by Bot2Bot	Git history (build timeline, not hours)	16 commits, all authored "Claude" with an Opus 5.5 co-author trailer, from 2026-10-23 1:05 PM PT to 2026-10-26 5:07 AM PT. The first commit alone adds 10,212 lines across 49 files, so earlier work is not visible.	Link · 2026-10-26
Unverified	Build cost and hours	Not disclosed. No token bill, usage export or hours published.	—
Measured by Bot2Bot	Setup from README	Pass on Node 22.20.0 (install 9.5 s, migrate 3.4 s, build 6.4 s, local worker ready ~3 s). README says Node 20+, but Wrangler 4.152 refused Node 20.19.2.	Link · 2026-10-26
Measured by Bot2Bot	Builder's own tests	vitest 18/18; builder smoke script 51/51; hosted-mode smoke 24/24.	— · 2026-10-26
Measured by Bot2Bot	Our core flow	19/19 functional steps passed: login, add site, pageviews and goal accepted (202), other-domain event 403, unknown site 404, oversize 413, payments API wrong key 401, payment attributed to the visitor, overview counts (1 visitor, 2 pageviews, $29.00), X/t.co referrer with revenue, realtime, customer journey, forged cookie 401, delete site.	— · 2026-10-26
Measured by Bot2Bot	Burst test (local D1)	50, 100 and 200 concurrent pageviews: 350/350 accepted and 350/350 stored as events and sessions in local D1; p95 340 / 396 / 559 ms. 100 concurrent dashboard reads 100/100, p95 376 ms.	— · 2026-10-26
Measured by Bot2Bot	npm audit	All dependencies: 3 critical, 1 high, 3 moderate (vitest/tinypool, wrangler/miniflare/undici dev tooling). Production only: 1 critical, maplibre-gl 5.24.0 (GHSA-jrc7-96c5-q579, fix is a major upgrade to 6.16.0); the app never calls setHTML or Popup, so the vulnerable path looks unused (not exploited).	— · 2026-10-26
Measured by Bot2Bot	Sessions	Session cookie is a stateless signed token valid 30 days: after logout, a copied cookie still opened the dashboard (200). If the example SESSION_SECRET from .dev.vars.example is kept, we could forge an admin cookie (200); a random secret, as the README tells you to set for deploys, refused our forged cookie (401).	— · 2026-10-26
Measured by Bot2Bot	Security headers	Dashboard and API responses send no CSP, X-Frame-Options, X-Content-Type-Options or Referrer-Policy (local wrangler dev). An open community PR (#3) proposes login, session and header hardening; not merged as of 2026-10-26.	Link · 2026-10-26
Measured by Bot2Bot	DataFast price (monthly confirmed)	Starter 10k events/mo, 1 website: $9/mo monthly or $90/yr. Growth 100k events, 30 websites: $39/mo monthly. 14-day free trial.	Link · 2026-10-26
Estimate	Run cost at 1 / 10 / 100 sites	$0 / $0 / $5 per month, assuming each site sends 10k events/mo: Cloudflare free plan up to ~10k pageviews/day; at 1M events/mo (~333k D1 rows written/day) you need Workers Paid $5/mo. From cited Cloudflare list prices, not a live deploy.	Link · 2026-10-26
Measured by Bot2Bot	Feature parity vs DataFast public list	10 of 29 matched, 2 partial, 17 missing (no native Stripe, team members, analytics read API, MCP/CLI, mobile app, cookieless mode, cross-domain, imports, plugins).	Link · 2026-10-26
Builder-stated	DataFast security posture (vendor pages)	DPA: HTTPS in transit, access controls, backups; subprocessors AWS, Vercel, Mapbox, OpenAI, MongoDB, Upstash, Tinybird, ClickHouse; data mostly outside the EU incl. US. No SOC 2 or ISO 27001 claim found on its public pages; /security returns 404.	Link · 2026-10-26
Unverified	Real Cloudflare deploy	Not tested. We ran the same Workers runtime (workerd) and a local D1 via wrangler dev; no Cloudflare account was used.	—
Unverified	Login lockout on Cloudflare	Locally, 10 wrong passwords locked the login for 15 minutes (429), including the right password from that IP. On Cloudflare the IP comes from the edge; not tested.	—

Acceptance criteria

Builder $ and time claims traced to his X posts, README or site with dates; undisclosed marked so
Setup from README on a fresh clone
Builder tests + our core flow + 100–200 concurrent burst counted in D1
npm audit, secrets, auth/session and headers on our copy only
Run cost at 1/10/100 sites from cited Cloudflare pricing; DataFast price re-read today, monthly vs yearly
Feature checklist vs DataFast's public feature list

No token usage export or invoice published. Builder says it can be built from one prompt (prompt not published).

No AI API calls at runtime. Upstream: 0 commits after our pin 6f71720 as of 2026-10-26 10:00 AM PT; 4 open PRs (Stripe, hardening, i18n, back arrow) and 1 open issue.

Run cost services

Cloudflare Workers Free (100,000 requests/day) — not deployed in this run
Cloudflare D1 Free (5 GB, 5M rows read/day, 100,000 rows written/day) — local D1 used
OpenFreeMap map tiles (free, no key)
Optional: Dodo Payments webhook for revenue; optional hosted SaaS mode (Google OAuth + Dodo plan)

Breakage / fix log

2026-10-26
Measured: README says Node.js 20+, but Wrangler 4.152 (the repo's version) refuses to run on Node 20.19.2.
Cause: Wrangler 4.x requires a newer Node than the README states.
Fix: Use Node 22 (we used portable Node 22.20.0). Docs fix only.

Status pages

Subscription it replaces

DataFast (Starter (10k monthly events, 1 website, paying monthly)) — $9.00/mo checked 2026-10-26. Source · see also /prices

Reliability notes

Local run on our box, 2026-10-26 (PT), Debian Linux, Node 22.20.0, commit 6f71720, wrangler dev (workerd runtime + local D1). Setup pass; vitest 18/18; builder smoke 51/51; hosted-mode smoke 24/24; our core flow 19/19; burst 50/100/200 concurrent pageviews all 202 and 350/350 stored in D1 (p95 559 ms at 200); 100 concurrent dashboard reads OK. Not tested: real Cloudflare edge, D1 latency over the network, multi-day uptime, real browsers.

Security check

Tested 2026-10-26 · Status: Open findings

npm audit (all deps and --omit=dev) at commit 6f71720
gitleaks on full git history and working tree
HTTP response headers on /, /js/script.js, /api and /login (local wrangler dev)
Sign-in and session: wrong password, lockout, forged cookie, cookie after logout, example SESSION_SECRET
Tracker endpoint: other domain, unknown site, oversize payload; payments API key check
DataFast: public homepage, privacy policy, DPA and terms only; no DataFast systems probed or logged into

npm audit, all deps: 3 critical, 1 high, 3 moderate, in dev tooling (vitest/tinypool, wrangler/miniflare/undici).
Production deps: 1 critical, maplibre-gl 5.24.0 GHSA-jrc7-96c5-q579 (sanitizer bypass); fix needs a major upgrade to 6.16.0. Minilytics never calls setHTML or Popup, so the path looks unused; not exploited.
gitleaks: 1 hit, a test fixture string in scripts/smoke-hosted.mjs (false positive). No real secrets in 16 commits.
No security headers on the dashboard or API (no CSP, clickjacking protection, nosniff or Referrer-Policy). HSTS not checked (localhost). Open community PR #3 proposes hardening.
Sessions are stateless signed cookies valid 30 days (HttpOnly, SameSite=Lax): logout only clears the browser cookie, so a copied cookie keeps working until it expires or you rotate SESSION_SECRET.
The app does not refuse the example SESSION_SECRET from .dev.vars.example: with it we forged an admin cookie (200). The README's deploy steps tell you to set a random one.
Login lockout: 10 wrong passwords lock login for 15 minutes per IP, including the right password (possible lockout of the owner). Constant-time password compare.
Tracker accepts events with CORS * and checks only the page URL in the body, so anyone who knows a site id can send fake pageviews (common to client-side analytics). Geo comes from request headers. Visitor IPs are not stored (except login failures).
Payments API needs the site's secret key (401 on a wrong key); Dodo webhooks are signature-checked (builder tests).

Own business

Total / mo: $0.00
Hosting / mo: $0.00

You run it on your own Cloudflare account and own the data (D1). No SOC 2 on the open-source project; DataFast lists no SOC 2/ISO claim on its public pages either. Set a random SESSION_SECRET and a strong password.

Cloudflare free-plan limits can change; above ~10k pageviews/day you need Workers Paid ($5/mo). DataFast prices are by events and websites.

Estimate at 1 site × 10k events/mo. Add your setup (~10 min per README; local steps took us under 30 s of commands) and upkeep time.

Sell @ 10 customers

Hosting / mo: $0.00

MIT license allows hosting it for others. Hosted mode (Google sign-in + Dodo plan) exists and passed its smoke test locally (24/24). You become the processor for 10 customers' visitor data; add headers and session hardening first.

Free plan still covers 10 × 10k events/mo; support load is yours.

Estimate: 10 sites × 10k events = 100k/mo on the free plan ($0). Those 10 owners would pay DataFast $9/mo each on Starter ($90), or one owner could use Growth 100k at $39/mo.

Sell @ 100 customers

Hosting / mo: $5.00

At 100 customers expect DPA, security-header and SOC 2 questions; the project has no compliance program. Single shared admin password in self-hosted mode; hosted mode uses Google sign-in.

1M events/mo needs Workers Paid $5/mo; D1 storage grows with history (5 GB included on Paid, then billed).

Estimate: 100 sites × 10k = 1M events/mo ≈ 10M D1 rows written/mo, within Workers Paid's included 50M. Not load-tested on Cloudflare.

Reproducible setup

git clone https://github.com/surendrapandar/minilytics.git && git checkout 6f71720
npm install (9.5 s)
cp .dev.vars.example .dev.vars (local only; set a random SESSION_SECRET for anything real)
npx wrangler d1 migrations apply minilytics --local (3.4 s)
npm test → vitest 18/18
npm run build (6.4 s)
npx wrangler dev --port 8787 (ready ~3 s)
npm run smoke → 51/51
Our core flow: node core_flow.mjs → 19/19 (+1 informational)
Our burst: 50/100/200 concurrent POST /api/event → 350/350 stored in local D1
npx wrangler d1 export minilytics --local --output dump.sql (export works)

Repo: https://github.com/surendrapandar/minilytics

License: MIT

Sources

Disclosure

Verification: Partially Verified. Bot2Bot Labs (internal quick receipt; $0 spend)

No relationship with the builder, DataFast, Cloudflare or Dodo Payments. The Minilytics README sells sponsor slots (badge: "$19/month early price", Dodo checkout) and the builder sells a hosted lifetime deal; the app has optional Dodo billing for its hosted mode. We bought neither.

Quick receipt, local only. Measured on our copy at commit 6f71720 on 2026-10-26: setup from README, builder tests, our core flow, a 350-event concurrent burst counted in local D1, npm audit, gitleaks, headers and session checks. Run costs are estimates from Cloudflare's public pricing; we did not deploy to Cloudflare. DataFast compared from its public pages only. Builder build cost and hours not disclosed.

Get this receipt for your AI-built app — Receipt Scan $19 →

For AI and citation

Machine-readable summary and citation line for crawlers, assistants, and footnotes. Content is always in the page HTML.

Key facts, quotable summary, and how to cite

Key facts

On price date 2026-10-26, estimated monthly run cost is $0.00 (estimate (cited Cloudflare list prices; app, tests, burst and security measured locally; no Cloudflare deploy)) versus $9.00/mo (DataFast Starter, 10k events/mo, 1 website) for the subscription it replaces. (2026-10-26) Source: DataFast
Free from day one at 1 site and 10k events/mo: $0/mo self-host vs $9/mo DataFast Starter (monthly), before your setup and upkeep time. At 100 sites the clone needs Workers Paid ($5/mo). (2026-10-26)
Git history (build timeline, not hours): 16 commits, all authored "Claude" with an Opus 5.5 co-author trailer, from 2026-10-23 1:05 PM PT to 2026-10-26 5:07 AM PT. The first commit alone adds 10,212 lines across 49 files, so earlier work is not visible.. (2026-10-26) Source: Git history (build timeline, not hours)
Setup from README: Pass on Node 22.20.0 (install 9.5 s, migrate 3.4 s, build 6.4 s, local worker ready ~3 s). README says Node 20+, but Wrangler 4.152 refused Node 20.19.2.. (2026-10-26) Source: Setup from README
Build cost on price date 2026-10-26: Not disclosed human hours, Not disclosed estimated token dollars, billed not disclosed. (2026-10-26) Source: Minilytics repo

Summary

On price date 2026-10-26, Bot2Bot Labs receipt r-0005 reports task "Quick receipt: Minilytics (MIT, open-source DataFast-style revenue analytics by @surendra_pandar, built with Claude/Opus 5.5) vs DataFast. Local only: we cloned commit 6f71720, followed the README on Node 22, ran the builder's tests, our 20-step core flow, a 350-event concurrent burst counted in local D1, npm audit, gitleaks and passive header/session checks on localhost. DataFast compared from its public pages only." with Not disclosed human hours, estimated token USD not disclosed, billed n/a.

How to cite

Bot2Bot Labs (2026-10-26). Minilytics, the AI-built DataFast alternative: what it costs to self-host. AI Receipt r-0005. Price date 2026-10-26. https://bot2botlabs.com/receipts/r-0005

Last updated: 2026-10-26 · https://bot2botlabs.com

Download all receipts (JSON)

More receipts

Everything Accounting vs QuickBooks: clone run cost · price date 2026-10-30
GridCraft vs Excel: clone run cost · price date 2026-10-28
MailCheap vs beehiiv: clone run cost · price date 2026-10-20
free-slack-clone vs Slack: clone run cost · price date 2026-10-21
PhotoCraft vs Photoshop: clone run cost · price date 2026-10-19
All receipts →