Alerts and webhooks, email reports, notes on the graph, bot and spam filtering, new privacy controls, and an MCP server for AI assistants.
Tidemark 0.31 is out. It adds ways to hear about your numbers without opening the dashboard, a handful of privacy controls, better filtering of bot traffic, and a read-only interface for AI assistants. Here is what changed and who gets what.
Email reports. Each person can ask for a weekly or monthly summary of any site they belong to, under Account settings → Email reports. It covers visitors, pageviews, bounce rate and visit duration against the period before, the top pages, sources and countries, goals with revenue, and the notes on your graph. It arrives at 08:00 in the site’s timezone, has no tracking pixel and no tracked links, and every message has an unsubscribe link.
Alerts and webhooks. Under Site settings → Alerts, create rules for a traffic spike or drop against the usual for that weekday and time, a goal reaching a number of conversions, new conversions of a goal, or a traffic source that sent nothing in the last 28 days. Send each rule by email, to Slack or Discord, or to your own service as signed JSON. Rules have quiet hours and cooldowns, failed deliveries are retried, and every message carries totals only, never anything about a visitor.
Notes on the graph. Add a short note to any date, such as “launched v2”, and it shows on the graph and in the table view. A note can be private, shared with everyone on the site, or shown on the public dashboard.
Privacy controls. Each site can now respect Global Privacy Control and Do Not Track, keep only the country or the region instead of the city, keep only a referrer’s domain, and decide which URL query parameters may be stored at all.
Small groups. Set a minimum, and public dashboards and shared links leave out rows with fewer visitors than that. A filter cannot narrow a public view down below it.
Masking personal data. Email addresses, tokens, UUIDs and long numbers that a site sends by accident in a page address, referrer or event are replaced with a placeholder before they are stored. Only a count of how often it happened is kept. On Tidemark Cloud this is always on. Self-hosted installs have it on by default.
Bot and spam filtering. On top of known crawlers, Tidemark now leaves out headless browsers, traffic from the address ranges of large cloud and hosting providers, referrer spam, and floods from a single visitor. It uses only what each request already carries, and keeps a daily count of what was filtered, by reason, which the site settings show. It is on by default and each site can turn it off, which helps when you are testing from a script or a server. A few people browse through VPNs hosted in those data centers, so the switch is there if you need it.
MCP server. An AI assistant can read a site’s stats through a read-only MCP endpoint. Create an API key under Account settings → Security, choose Read-only, and paste the configuration it shows into your assistant. It can read totals, trends, top pages and sources, goals and funnels, and nothing else.
Read-only API keys. A read-only key can only read statistics through the Stats API and MCP. Full-access keys still have the same access as their owner.
Stats API and OpenAPI. The Stats API gains goals and funnels, and the whole API is described in an OpenAPI document at /api/v1/openapi.json, so you can generate a client in the language you use.
On Tidemark Cloud, alerts and webhooks come with Pro. Everything else above is on Free too, including email reports, notes, bot filtering, the privacy controls, the API and MCP. Self-hosted installs get all of it.
Updating a self-hosted install needs nothing special: take the new release from the in-app updater or pull the new Docker image, and the migrations run on their own. The full list is in the changelog.