Compare Insights and Tinylytics on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Fathom Analytics, Google Analytics
Austria· Web Analytics
Needs review
Shortlist when you need cookie-free hosted analytics with first-class custom events for SPAs from an Austrian operator. Skip when you need self-host, public ISO/SOC packs, or infrastructure without Google Firebase—consider Plausible Analytics, Simple Analytics, or Pirsch Analytics instead (or self-hosted Matomo).
United Kingdom· Web Analytics
Needs review
Shortlist Tinylytics when you want cookieless page analytics plus bundled uptime/SSL/content checks for a handful of small sites, with primary data on Hetzner in Germany and founder support. Skip when you need self-host/open source, formal ISO/SOC packs, or enterprise multi-tenant governance—consider Plausible Analytics or Simple Analytics instead.
Highlighted rows differ between the two products.
| Feature | Insights | Tinylytics |
|---|---|---|
| Country of origin | Austria | United Kingdom |
| Category | Web Analytics | Web Analytics |
| Open source | Yes | No |
| Self-hosted | No | No |
| Headquarters | Austria | United Kingdom |
| Legal entity | Unsourced Digital OG | Vincent Ritter Consulting (service brand; terms state not separately incorporated yet) |
| Governing law | Not listed | Not clearly stated as a single governing-law clause on the public terms page; confirm contractually |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Medium |
| Hosting / residency | Operator: Unsourced Digital OG (Austria). Vendor-documented infrastructure includes Google Firebase—Cloud Functions, Firebase Authentication (customer accounts), and Firebase Hosting—with temporary IP handling described for those Google services. Visitor analytics designed without cookies and without IP storage in DB/logs; still a US-group cloud path for processing/hosting/auth. | Primary analytics storage: Hetzner Falkenstein (Germany). CDN/security: Cloudflare. Error monitoring: Sentry.io. Payments: Paddle and Lemon Squeezy (Stripe company). Optional: IPinfo geo fallback for API hits; opt-in AI Insights via xAI and Google Gemini. No public backup-provider detail beyond that stack. |
| Summary | Austrian privacy-first hosted web analytics: page views and custom events without cookies or stored visitor IPs, with an MIT open-source JS client (backend uses Google Firebase). | Privacy-first cookieless web analytics for small sites, with bundled uptime/SSL checks, content monitoring, events, and founder support—hosted primarily on Hetzner in Germany. |
| Tags |
| At a glance | Insights | Tinylytics |
|---|---|---|
| HQ / law | Austria (Unsourced Digital OG; Austrian governing law) | Not listed |
| Product type | Hosted privacy web analytics + custom events | Not listed |
| Client license | MIT (insights-js); backend proprietary | Not listed |
| Self-host | No public self-host option | Not listed |
| Commercial model | Free low-volume tier; paid by monthly event/pageview volume | Paid site-count plans; short trial; no permanent free tier |
| Known infra | Google Firebase (Functions, Auth, Hosting) per vendor docs | Not listed |
| HQ / operator | Not listed | Vincent Ritter Consulting, United Kingdom |
| Launched | Not listed | 12 June 2023 (live counters on homepage) |
| Primary hosting | Not listed | Hetzner, Falkenstein, Germany |
| Deployment | Not listed | Managed SaaS only (not open source, not self-hosted) |
| Differentiators | Not listed | Analytics + uptime/SSL/content monitoring + widgets |
| Key capabilities | Insights | Tinylytics |
|---|---|---|
| Cookie-free tracking | Yes | Not listed |
| Custom events | Yes | Not listed |
| MIT client (insights-js) | Yes | Not listed |
| Austrian entity | Yes | Not listed |
| Hosted SaaS | Yes | Not listed |
| Firebase data path | Yes | Not listed |
| Cookieless analytics | Not listed | Yes |
| Primary host: Hetzner DE | Not listed | Yes |
| Uptime + SSL monitoring | Not listed | Yes |
| Broken-link crawls | Not listed | Yes |
| SaaS only (no self-host) | Not listed | Yes |
| Solo-founder UK | Not listed | Yes |
Cookie-free page views and user flows
Tracks bounce rate, referrers, visits, and user-flow style page statistics without setting analytics cookies, so sites can avoid cookie banners driven solely by analytics. Script init plus trackPages() is the usual path for SPAs.
Custom and cancelable event tracking
insights-js supports named events with string parameters, unique-per-session flags, parameter-only updates, and remove/cancel for long-lived events (e.g. subscribe then unsubscribe). Built for product and funnel metrics, not pageviews only.
MIT open-source TypeScript client
The browser/npm client (insights-js) is MIT-licensed on GitHub with TypeScript types and helpers for locale, screen type, path, referrer, and duration buckets. Supports React, Angular, Vue, UMD script, and multi-project App instances. Backend remains proprietary SaaS.
Visitor anonymization pipeline (vendor-described)
Vendor docs: IPs hashed only in RAM for fraud checks (not stored in DB or logs); user agents reduced to browser/OS; optional screen sizes rounded to 50px; Do Not Track honoured. Confirm fit with your DPO—anonymous design is not a legal certification.
Developer-oriented integration
One-minute script install or npm package; docs cover multi-project tracking, ignoreErrors/disabled flags for production environments, and hash/search options on page paths. Lightweight client positioned against heavier GA-style tags.
Cookie-free unique hits with rotating salts
Page views and unique hits without tracking cookies or fingerprinting. Uniques combine truncated request signals with a 12-hour rotating salt and one-way hash, reset daily at midnight UTC; visitor IPs are not stored in hits. Suited to indie sites that want trendable uniques without consent banners for analytics cookies.
Thunder Clap uptime, SSL, and domain alerts
In-house multi-region health checks (default every 10 minutes) confirm downtime before emailing, plus SSL expiry notices and domain monitoring. Ultra can shorten intervals. Replaces a separate uptime tool for small fleets—but false downs can occur if WAFs block the Tinylytics monitor user-agent.
Daily content crawl for broken links and mixed content
Subscribed sites can crawl up to 50 pages (two levels deep) on a daily cadence, flagging broken links and mixed HTTP assets on HTTPS pages, with ignore lists and re-check. Ultra adds optional AI spell-check on visible copy—keep it off if AI subprocessors are out of policy.
Attribute-based event tracking (beta)
Enable events on the embed script and mark elements with data-tinylytics-event using category.action names (optional values for downloads). No GTM required; beacon mode helps navigations. Still beta—expect API/schema changes and incomplete capture under aggressive blockers.
Public stats, kudos, hit counters, API, and webhooks
Share passcode-protected public stats, embed hit counters and kudos buttons, export CSV, call the documented API, and push signed webhooks for visits, events, and monitoring. Built for transparent blogs and light automation rather than enterprise BI warehouses.
| Assurance & compliance | Insights | Tinylytics |
|---|---|---|
| Independent security / no-logs audit | Not found Vendor describes no IP storage in DB/logs and RAM-only hashing; no public third-party audit PDF found. | Not found No public third-party security or no-logs audit report found on official docs. |
| ISO 27001 | Not found No public certificate on getinsights.io at research time. | Not found No ISO 27001 claim found on privacy, compliance, or hosting pages. |
| SOC 2 / SOC 3 | Not found No public SOC report found. | Not found No SOC 2/3 report or claim found on public site. |
| GDPR / EU data protection | Vendor claimed Austrian entity; privacy policy and data-collection docs; cookie-free/no-stored-IP design for visitors. Firebase/Google processing still requires transfer/DPA diligence. | Vendor claimed Vendor documents GDPR-oriented design (cookieless, data minimisation, EU primary host, deletion). Not independent certification. |
| US CLOUD Act exposure (indicative) | Partial EU entity / no known US parent, but Google Firebase (US-group) used for Cloud Functions, Auth, and Hosting per vendor data page. Indicative medium exposure. Not legal advice. | Partial UK operator, no known US parent, primary host Hetzner DE; partial exposure via Cloudflare, Sentry, Lemon Squeezy/Paddle, optional IPinfo and opt-in US AI APIs. Not legal advice. |
| Data processing agreement (B2B) | Not found No standalone public DPA page found; request from contact@getinsights.io for B2B use. | Not found No public DPA/downloadable processor agreement found; ask the vendor before B2B rollout. |
| EU AI Act | Not applicable Web analytics product, not an AI system product page. | Not applicable Core product is analytics/monitoring; optional AI insights are secondary and opt-in. |
| Considerations & known limitations | Insights | Tinylytics |
|---|---|---|
| Google Firebase on critical path | High Vendor documents Firebase Cloud Functions, Auth, and Hosting. Anonymous visitor design does not remove US-group cloud dependency for hosting/auth/processing—material for sovereignty-sensitive buyers. | Not listed |
| No public independent audit or certs | Medium No ISO 27001, SOC 2, or third-party no-logs audit found on the public site. Rely on vendor claims plus your own review of the open client. | Not listed |
| Client open source only; no self-host | Medium insights-js is MIT; dashboard/backend are closed SaaS. You cannot run the full product on your infrastructure. | Not listed |
| Small team / continuity | Medium Product presented as built by two freelance developers under Unsourced Digital OG. Assess vendor longevity and support SLAs for business-critical analytics. | Not listed |
| Bounce/unique metrics need SPA routing | Low Client docs: trackPages bounce and unique views expect a client-side router and do not use cookies/localStorage; multi-page full reloads can skew metrics. | Not listed |
| US-group subprocessors on the data path | Not listed | Medium Cloudflare, Sentry, payment processors (incl. Lemon Squeezy/Stripe group), optional IPinfo and opt-in xAI/Gemini mean the stack is not EU-only end-to-end despite Hetzner primary storage. |
| Solo-founder operational concentration | Not listed | Medium Service is provided by Vincent Ritter Consulting / a solo developer. Support is personal and fast for indies, but bus-factor and formal SLA expectations differ from larger vendors. |
| No public ISO/SOC/audit or DPA pack | Not listed | Medium Enterprise security questionnaires will hit gaps until the vendor supplies audits and a B2B DPA under NDA or email. |
| Scale and feature boundaries | Not listed | Low Content crawls are depth/page limited; event tracking is beta; fair-usage applies to extreme hit volumes; no self-host escape hatch. |
| Optional AI shares aggregated analytics | Not listed | Low AI Insights and related AI spell-check are opt-in and send aggregated (not visitor PII per vendor) data to third-party AI providers—leave disabled under strict AI policies. |
When: You want simple hosted EU privacy page analytics with a strong Plausible-style product footprint
Consider: Plausible Analytics
Compare event depth: Insights markets custom events as a core differentiator vs simpler page-focused tools.
When: You want cookie-free analytics with an explicit privacy brand and different commercial packaging
Consider: Simple Analytics
Verify each vendor's hosting and subprocessor pages side by side.
When: You prefer a German peer privacy analytics product
Consider: Pirsch Analytics
Compare event features, regions, and legal docs for your DPA process.
When: You need full control of the stack or on-prem processing
Consider: Self-hosted Matomo (or similar open analytics)
Higher ops cost; no dependency on Insights SaaS or Firebase.
When: You need open-source and optional self-hosting of the analytics stack
Consider: Plausible Analytics
Estonian product with Cloud plus Community Edition self-host; less bundling of uptime/content monitors.
When: You want European cookieless analytics with a simpler analytics-only scope
Consider: Simple Analytics
Strong privacy positioning; compare feature depth and monitoring separately.
When: You need free-at-scale marketing analytics, ads integrations, or attribution depth
Consider: Google Analytics (incumbent) — or stay on a privacy tool if GA is disallowed
Different privacy and sovereignty profile entirely.
When: You need session replay or heatmaps and accept that privacy model
Consider: Microsoft Clarity or specialised replay tools
Tinylytics deliberately avoids fingerprinting-style session products.