Compare digistats Analytics and Tinylytics on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Fathom Analytics, Google Analytics
Switzerland· Web Analytics
Needs review
Shortlist digistats when you want managed Swiss cookieless analytics with multi-site, events, API, and CSV on every listed tier and you accept SaaS-only operations. Skip when you need self-host/OSS, GA4-depth product analytics, or published ISO 27001/SOC 2—consider Plausible, Simple Analytics, Pirsch, or Matomo instead.
United Kingdom· Web Analytics
Needs review
Shortlist Tinylytics when you want cookieless page analytics plus bundled uptime/SSL/content checks for a handful of small sites, with primary data on Hetzner in Germany and founder support. Skip when you need self-host/open source, formal ISO/SOC packs, or enterprise multi-tenant governance—consider Plausible Analytics or Simple Analytics instead.
Highlighted rows differ between the two products.
| Feature | digistats Analytics | Tinylytics |
|---|---|---|
| Country of origin | Switzerland | United Kingdom |
| Category | Web Analytics | Web Analytics |
| Open source | No | No |
| Self-hosted | No | No |
| Headquarters | Switzerland | United Kingdom |
| Legal entity | digistats Analytics Ltd., Täfernstrasse 2A, CH-5405 Dättwil AG (UID CHE-296.235.462) | Vincent Ritter Consulting (service brand; terms state not separately incorporated yet) |
| Governing law | Swiss law; venue Bremgarten AG (per AGB) | Not clearly stated as a single governing-law clause on the public terms page; confirm contractually |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Medium |
| Hosting / residency | Privacy policy: customer data processed/stored in Switzerland, not in the USA or outside the EU; pricing lists Switzerland Data Center. Hosting provider legal name not in a public subprocessor list. Payment subprocessors: Stripe, Inc. (USA) and Coinbase (crypto; German entity listed in AGB). | Primary analytics storage: Hetzner Falkenstein (Germany). CDN/security: Cloudflare. Error monitoring: Sentry.io. Payments: Paddle and Lemon Squeezy (Stripe company). Optional: IPinfo geo fallback for API hits; opt-in AI Insights via xAI and Google Gemini. No public backup-provider detail beyond that stack. |
| Summary | Swiss cookieless web analytics SaaS from digistats Analytics Ltd.: realtime traffic, city-level geo, events, and multi-site dashboards without storing cookies, IPs, or fingerprints. | Privacy-first cookieless web analytics for small sites, with bundled uptime/SSL checks, content monitoring, events, and founder support—hosted primarily on Hetzner in Germany. |
| Tags |
| At a glance | digistats Analytics | Tinylytics |
|---|---|---|
| HQ | Dättwil AG, Switzerland | Not listed |
| Legal entity | digistats Analytics Ltd. (CHE-296.235.462) | Not listed |
| Hosting | Switzerland data center (host brand not named publicly) | Not listed |
| Deployment | Managed SaaS only | Managed SaaS only (not open source, not self-hosted) |
| Open source | No | Not listed |
| Commercial model | Free low-traffic tier + pageview-based subscription | Paid site-count plans; short trial; no permanent free tier |
| HQ / operator | Not listed | Vincent Ritter Consulting, United Kingdom |
| Launched | Not listed | 12 June 2023 (live counters on homepage) |
| Primary hosting | Not listed | Hetzner, Falkenstein, Germany |
| Differentiators | Not listed | Analytics + uptime/SSL/content monitoring + widgets |
| Key capabilities | digistats Analytics | Tinylytics |
|---|---|---|
| Cookieless tracking | Yes | Yes |
| No stored visitor IPs | Yes | Not listed |
| Swiss data center | Yes | Not listed |
| Unlimited websites | Yes | Not listed |
| API + CSV export | Yes | Not listed |
| Managed SaaS | Yes | Not listed |
| Primary host: Hetzner DE | Not listed | Yes |
| Uptime + SSL monitoring | Not listed | Yes |
| Broken-link crawls | Not listed | Yes |
| SaaS only (no self-host) | Not listed | Yes |
| Solo-founder UK | Not listed | Yes |
Cookieless script without stored IPs or fingerprints
Vendor docs describe a sub-1 kB tag that measures traffic without cookies, without retaining visitor IPs (IP used only for live geo lookup), and without fingerprinting—aimed at sites that want analytics without a consent banner for non-essential cookies.
Realtime dashboard with geo, tech, events, and channels
Live visitor and pageview views plus city-level geography, browser/OS/device signals, custom conversion events, referrer/search/social acquisition, landing pages, and continuous site reachability (online status)—enough for content and marketing ops, not a full product-analytics suite.
Ad-blocker-resistant capture (vendor claim)
Marketing materials contrast digistats with Google Analytics being stripped by major blockers and state digistats is not blocked by common ad-block extensions. Useful for traffic completeness debates; treat as first-party claim until you validate on your stack.
Multi-site SaaS with API, email reports, and CSV on every tier
Published plans include unlimited websites and events, API access, email reports, Swiss data-center storage, and CSV export—even on the free low-traffic tier—so agencies can run multiple client properties without plan-gated feature cliffs.
Swiss entity and Swiss analytics data center
Operated by digistats Analytics Ltd. (Dättwil AG); privacy policy commits to storing customer data in Switzerland. Managed hosting only—no self-hosted edition in public materials.
Cookie-free unique hits with rotating salts
Page views and unique hits without tracking cookies or fingerprinting. Uniques combine truncated request signals with a 12-hour rotating salt and one-way hash, reset daily at midnight UTC; visitor IPs are not stored in hits. Suited to indie sites that want trendable uniques without consent banners for analytics cookies.
Thunder Clap uptime, SSL, and domain alerts
In-house multi-region health checks (default every 10 minutes) confirm downtime before emailing, plus SSL expiry notices and domain monitoring. Ultra can shorten intervals. Replaces a separate uptime tool for small fleets—but false downs can occur if WAFs block the Tinylytics monitor user-agent.
Daily content crawl for broken links and mixed content
Subscribed sites can crawl up to 50 pages (two levels deep) on a daily cadence, flagging broken links and mixed HTTP assets on HTTPS pages, with ignore lists and re-check. Ultra adds optional AI spell-check on visible copy—keep it off if AI subprocessors are out of policy.
Attribute-based event tracking (beta)
Enable events on the embed script and mark elements with data-tinylytics-event using category.action names (optional values for downloads). No GTM required; beacon mode helps navigations. Still beta—expect API/schema changes and incomplete capture under aggressive blockers.
Public stats, kudos, hit counters, API, and webhooks
Share passcode-protected public stats, embed hit counters and kudos buttons, export CSV, call the documented API, and push signed webhooks for visits, events, and monitoring. Built for transparent blogs and light automation rather than enterprise BI warehouses.
| Assurance & compliance | digistats Analytics | Tinylytics |
|---|---|---|
| Independent security / no-logs audit | Not found Vendor claims no IP storage and no fingerprints; no public third-party audit PDF found. | Not found No public third-party security or no-logs audit report found on official docs. |
| ISO 27001 | Not found Not claimed on reviewed pages. Host partner ISO 14001 (environmental) is not an ISMS cert. | Not found No ISO 27001 claim found on privacy, compliance, or hosting pages. |
| SOC 2 / SOC 3 | Not found | Not found No SOC 2/3 report or claim found on public site. |
| GDPR / EU data protection | Vendor claimed Swiss entity; privacy policy cites DSG and GDPR/DSGVO, cookieless design, Swiss storage. Not legal advice. | Vendor claimed Vendor documents GDPR-oriented design (cookieless, data minimisation, EU primary host, deletion). Not independent certification. |
| US CLOUD Act exposure (indicative) | Partial Swiss Ltd, no known US parent, analytics residency claimed in Switzerland; billing via Stripe, Inc. (US) and Coinbase. EuropeanStack assessment — not a vendor certification. Not legal advice. | Partial UK operator, no known US parent, primary host Hetzner DE; partial exposure via Cloudflare, Sentry, Lemon Squeezy/Paddle, optional IPinfo and opt-in US AI APIs. Not legal advice. |
| Data processing agreement (B2B) | Partial Privacy policy describes Art. 28-style processing on behalf of customers; dedicated public DPA download not found — request signed DPA. | Not found No public DPA/downloadable processor agreement found; ask the vendor before B2B rollout. |
| EU AI Act | Not applicable Web analytics product; not positioned as an AI system product. | Not applicable Core product is analytics/monitoring; optional AI insights are secondary and opt-in. |
| Considerations & known limitations | digistats Analytics | Tinylytics |
|---|---|---|
| No public independent security audit | Medium Cookieless and no-IP claims are first-party only. Security questionnaires that require audit reports will need vendor outreach or a different product. | Not listed |
| US-linked payment subprocessors | Medium AGB names Stripe, Inc. (San Francisco) for cards and Coinbase for crypto. Billing and account data may leave the pure Swiss analytics path even if telemetry stays in Switzerland. | Not listed |
| Hosting provider not named publicly | Low Switzerland data-center claim without a published host legal name or full subprocessor list complicates transfer and residual-risk assessments. | Not listed |
| No self-host or open-source path | Medium Cannot pin collector versions, run fully air-gapped, or satisfy hard self-host mandates. Operational dependency on digistats uptime and roadmap. | Not listed |
| Registration path may be restricted | Low At research time the login UI stated registrations were disabled and /developers redirected to login. Confirm trial and API access before scheduling migration. | Not listed |
| US-group subprocessors on the data path | Not listed | Medium Cloudflare, Sentry, payment processors (incl. Lemon Squeezy/Stripe group), optional IPinfo and opt-in xAI/Gemini mean the stack is not EU-only end-to-end despite Hetzner primary storage. |
| Solo-founder operational concentration | Not listed | Medium Service is provided by Vincent Ritter Consulting / a solo developer. Support is personal and fast for indies, but bus-factor and formal SLA expectations differ from larger vendors. |
| No public ISO/SOC/audit or DPA pack | Not listed | Medium Enterprise security questionnaires will hit gaps until the vendor supplies audits and a B2B DPA under NDA or email. |
| Scale and feature boundaries | Not listed | Low Content crawls are depth/page limited; event tracking is beta; fair-usage applies to extreme hit volumes; no self-host escape hatch. |
| Optional AI shares aggregated analytics | Not listed | Low AI Insights and related AI spell-check are opt-in and send aggregated (not visitor PII per vendor) data to third-party AI providers—leave disabled under strict AI policies. |
When: You need open-source and optional self-hosting with a large community
Consider: Plausible Analytics or Matomo
Plausible is cookieless SaaS + self-host; Matomo is the full self-host suite.
When: You want another lightweight EU cookieless SaaS without Swiss seat as a requirement
Consider: Simple Analytics or Pirsch Analytics
NL and DE peers in the same category band.
When: You need enterprise analytics, tag manager, and formal compliance packaging
Consider: Piwik PRO or Matomo Cloud
Heavier stacks with more modules and B2B assurance artifacts.
When: You are comparing global privacy-analytics brands rather than Swiss residency
Consider: Fathom Analytics
Different ownership and data-path story—verify residency independently.
When: You need open-source and optional self-hosting of the analytics stack
Consider: Plausible Analytics
Estonian product with Cloud plus Community Edition self-host; less bundling of uptime/content monitors.
When: You want European cookieless analytics with a simpler analytics-only scope
Consider: Simple Analytics
Strong privacy positioning; compare feature depth and monitoring separately.
When: You need free-at-scale marketing analytics, ads integrations, or attribution depth
Consider: Google Analytics (incumbent) — or stay on a privacy tool if GA is disallowed
Different privacy and sovereignty profile entirely.
When: You need session replay or heatmaps and accept that privacy model
Consider: Microsoft Clarity or specialised replay tools
Tinylytics deliberately avoids fingerprinting-style session products.