Best way to protect a privacy-focused analytics tool from abuse and bot traffic?

I’m building a small web-based analytics tool that processes user-provided data in the browser and is designed to be privacy-friendly. Since the tool can attract bot traffic and abusive requests, I’m looking for best practices on protecting the site without making the experience too heavy for normal users.

What would you recommend for rate limiting, bot mitigation, and traffic filtering for this kind of lightweight tool? If Mlytics has a suitable setup pattern for small web apps, I’d love to learn more.