Compare nilly and Pirsch Analytics on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Fathom Analytics, Google Analytics
Switzerland· Web Analytics
Needs review
Shortlist nilly when you want Swiss-entity, cookieless, ultra-light site analytics with realtime dashboards, city geo, custom events, unlimited sites, and an API—without GA4 consent weight. Skip when you need self-host/open source, enterprise audit packs, or deep marketing-suite analytics; consider Plausible Analytics, Simple Analytics, or etracker instead.
Germany· Web Analytics
Needs review
Shortlist Pirsch when you want German-operated, cookie-free web analytics with funnels/events, agency white-label, and a public DPA—hosted on Hetzner per vendor docs. Skip when you need free full-product self-host, session replay/heatmaps, or a stack with zero US-group subprocessors; consider Plausible or Simple Analytics instead.
Highlighted rows differ between the two products.
| Feature | nilly | Pirsch Analytics |
|---|---|---|
| Country of origin | Switzerland | Germany |
| Category | Web Analytics | Web Analytics |
| Open source | No | Yes |
| Self-hosted | No | No |
| Headquarters | Switzerland | Germany |
| Legal entity | Lyo GmbH, Europaallee 41, 8004 Zürich (CHE-417.675.763) | Emvi Software GmbH (Nickelstraße 1b, 33378 Rheda-Wiedenbrück; HRB 11575, AG Gütersloh) |
| Governing law | Switzerland (terms) | Germany / EU GDPR |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Medium |
| Hosting / residency | Vendor FAQ: analytics servers in Switzerland (multiple locations). Public site reverse-DNS: KreativMedia/METANET Zürich. Customer-account subprocessors named in privacy policy: Stripe (US payments), Mailerlite (email). Avatars via Gravatar. No full public subprocessor list for backups/monitoring/CDN. | Analytics: Hetzner Online GmbH, Germany (vendor claims Nuremberg/Falkenstein). Account/ops subprocessors named in privacy policy include AWS SES (Amazon Web Services EMEA), Google Workspace (Google Cloud EMEA), Stripe, Inc. (US), Intuition Machines, Inc. (US CAPTCHA), and Datev eG (DE). |
| Summary | Swiss privacy-first web analytics (Lyo GmbH): cookieless, sub-1kB tracking with realtime dashboards, city-level geo, custom events, unlimited sites, and a REST API as a lightweight Google Analytics alternative. | Cookie-free web analytics from Emvi Software GmbH in Germany: hash-based visitor IDs, open-source core, Hetzner-hosted SaaS with funnels, events, and agency white-label. |
| Tags |
| At a glance | nilly | Pirsch Analytics |
|---|---|---|
| HQ | Zürich, Switzerland (Lyo GmbH) | Rheda-Wiedenbrück, Germany |
| Legal entity | Lyo GmbH (CHE-417.675.763) | Emvi Software GmbH |
| Product model | SaaS web analytics (not self-hosted) | Not listed |
| Tracking | Cookieless; no IP/fingerprint claims | Not listed |
| Hosting (claimed) | Switzerland (multi-site) | Not listed |
| Commercial model | Traffic-based plans; trial; no permanent free tier | Usage-based (monthly page views); trial available |
| Live site note | kandur.one (nilly branding; nilly.io DNS failed at research) | Not listed |
| Category | Not listed | Web analytics (SaaS) |
| Open source | Not listed | Core library AGPL-3.0; full SaaS commercial |
| Self-host | Not listed | Enterprise on-prem option; not free CE |
| Primary hosting (claimed) | Not listed | Hetzner Germany (Nuremberg/Falkenstein) |
| Key capabilities | nilly | Pirsch Analytics |
|---|---|---|
| Cookieless tracking | Yes | Not listed |
| Swiss-hosted (claimed) | Yes | Not listed |
| Swiss entity | Yes | Not listed |
| Sub-1 kB script | Yes | Not listed |
| REST API | Yes | Not listed |
| SaaS only | Yes | Not listed |
| Cookie-free hashing | Not listed | Yes |
| Open-source core (AGPL) | Not listed | Yes |
| Hetzner DE hosting (claimed) | Not listed | Yes |
| Server-side tracking | Not listed | Yes |
| Agency white-label | Not listed | Yes |
| Public DPA/AVV | Not listed | Yes |
Sub-1 kB cookieless tracking script
Vendor documents a client script under 1 kB with no cookies, no IP tracking, and no fingerprinting for site visitors. Suited to teams that want aggregate traffic metrics without analytics cookie banners; still get counsel for your jurisdiction and CMP setup.
Realtime dashboard with geo, tech, and campaigns
Dashboards cover live visitors, overview metrics, top pages, referrers, UTM campaigns, geography from continent to city, and device/browser/OS breakdowns—enough for content and acquisition decisions without a full product-analytics suite.
Custom events, CSV export, and email reports
Define custom events for conversion-style actions, export statistics as CSV, and receive email reports. Fits operators who need lightweight conversion signals and offline analysis rather than session replay or multi-step funnels.
REST API for stats, websites, and account
Documented API endpoints (Bearer API key) manage stats queries (pageviews, visitors, referrers, events, geo, devices, and more), websites, and account objects—useful for internal dashboards or automations on traffic-based plans that include API access.
Unlimited websites on traffic-based plans
Public pricing model is pageview-tier SaaS with unlimited websites per account and a short free trial—not a permanent free tier. Good for agencies or multi-brand operators who outgrow per-site free plans elsewhere; confirm current tiers on the vendor site.
Cookie-free 24-hour visitor hashing
Recognizes visitors without cookies by hashing IP, User-Agent, date, and a per-site salt into a short ID. The vendor states IPs are not stored and cross-site linkage is blocked by the salt; sessions expire after 24 hours so long-term profiles are not built. Best for sites that want aggregate traffic metrics without a dedicated analytics cookie banner—confirm ePrivacy/TTDSG fit with counsel.
Server-side and script integrations
Instrument via JS snippet, CMS plugins (e.g. WordPress, Shopify, Webflow, Framer), or backend SDKs/API (Go library and other stacks). Server-side collection improves resilience when ad blockers strip client scripts. Tradeoff: backend integration costs more engineering time than a single script tag.
Funnels, events, goals, and tag segmentation
Goes past pageviews with custom events, conversion goals, multi-step funnels, session path exploration, outbound/download/404 tracking, and tags for A/B tests or channel segmentation. Webhooks and email reports push insights into existing tools. Some advanced metrics (e.g. custom event metrics, e-commerce revenue tracking) sit on higher commercial tiers—verify the live feature matrix.
Agency white-label and shared dashboards
Custom domains, themes, logos, and broader white-label options let agencies present analytics under their own brand. Public dashboards and unique access links support clients without full account sprawl; roles/teams scale collaboration. Strong fit for multi-client portfolios; less relevant for a single personal blog.
Migration imports, API, and unlimited retention (stated)
Import historical data from Google Analytics, Plausible, or Fathom; export CSV; use the REST API and SDKs for custom pipelines. Pricing docs state unlimited data retention across Standard, Plus, and Enterprise. Limits are usage-based on monthly page views (events and a share of session extensions count)—plan for growth, not perpetual free volume.
| Assurance & compliance | nilly | Pirsch Analytics |
|---|---|---|
| Independent security / no-logs audit | Not found No public third-party audit report found for tracking claims. | Not found Open-source core allows code review; no public third-party audit PDF located in this research pass. |
| ISO 27001 | Not found No vendor ISO 27001 certificate published on product site (underlying Swiss host DCs may be certified separately). | Not found No ISO 27001 certificate or registry entry found on official trust pages reviewed. |
| SOC 2 / SOC 3 | Not found | Not found No public SOC 2/3 report referenced on official pages reviewed. |
| GDPR / EU data protection | Vendor claimed Swiss entity; privacy policy includes GDPR rights language; cookieless visitor tracking claimed. Confirm DPA for B2B. | Vendor claimed German controller/processor Emvi Software GmbH; cookie-free hashing design; public DPA; German Hetzner hosting claims. Vendor also cites CCPA/PECR/Schrems II—treat as claims, confirm with counsel. |
| US CLOUD Act exposure (indicative) | Partial Swiss operator, no known US parent, Swiss-claimed analytics hosting; US SaaS subprocessors Stripe (payments) and Gravatar (avatars) on customer path. Not legal advice. | Partial EU entity / no known US parent and Hetzner DE analytics hosting, but privacy policy names AWS SES, Google Workspace, Stripe, and Intuition Machines (US-group services) for email/CAPTCHA/payments. Not legal advice. |
| Data processing agreement (B2B) | Not found No public DPA download found; request from vendor. | Vendor claimed Downloadable English DPA and German AVV PDFs linked from docs.pirsch.io/privacy. |
| EU AI Act | Not applicable Web analytics product; not marketed as an AI system. | Not applicable Classical web analytics product; not marketed as an AI system. |
| Swiss Made Software / Swiss Web labels | Vendor claimed Cited on About and Swiss Union member page as recognition/labels—not a security audit. | Not listed |
| Considerations & known limitations | nilly | Pirsch Analytics |
|---|---|---|
| Brand/domain transition (nilly.io vs kandur.one) | Medium Product still branded nilly, but the live marketing/API host is kandur.one; nilly.io did not resolve in DNS during research. Verify tracking domains, docs, and status before production cutover. | Not listed |
| US SaaS on customer account path | Medium Stripe (payments) and Gravatar (avatars) are US-group services. Visitor metrics are claimed Swiss-hosted and non-personal, but account/billing data is not Switzerland-only end-to-end. | Medium Even with German analytics hosting claims, customer email, CAPTCHA, and payments involve AWS, Google, Stripe, and Intuition Machines. Sovereign or “no US cloud” policies need explicit exception handling or Enterprise architecture review. |
| Thin public assurance pack | Medium No public ISO 27001/SOC 2, independent security audit, or DPA page found. Fine for many SMB shortlists; friction for regulated enterprise questionnaires. | Not listed |
| No self-host or open-source edition | Low Cannot run on your own infra or audit server code from a public repo. Hard limit for sovereignty programs that require self-host. | Not listed |
| Small independent operator | Low Founder-owned Swiss GmbH without VC narrative—positive for independence, but buyers should assess support SLAs, roadmap continuity, and single-vendor concentration. | Not listed |
| No public ISO/SOC or third-party audit | Not listed | Medium Procurement teams that require ISO 27001 or SOC 2 evidence will need vendor questionnaires or NDA materials; public pages did not show those certs. |
| Open-source core ≠ free full self-host | Not listed | Low Teams assuming AGPL means free on-prem of the entire product may be surprised; full on-prem is positioned as Enterprise. |
| Fingerprinting still needs legal fit review | Not listed | Low Cookie-free hashing is not automatically lawful everywhere without information/consent analysis. Banner removal should be validated for your jurisdiction and tag stack. |
| Page-view usage limits | Not listed | Low Plans are metered on monthly page views (with events and partial session extensions counting). Hitting the cap can restrict dashboard access until upgrade or cycle reset—model traffic before cutover. |
When: You want open-source and/or self-host privacy analytics with a larger community
Consider: Plausible Analytics or Pirsch Analytics
nilly is proprietary SaaS only.
When: You want another European cookieless SaaS with a simple product story
Consider: Simple Analytics
Dutch peer; compare geo depth, API, and residency claims side by side.
When: You need deeper marketing, shop, and tag/consent analytics for EU enterprises
Consider: etracker
German suite-oriented alternative; heavier than nilly's lightweight dashboard.
When: You depend on free unlimited scale and Google ads/ecosystem integration
Consider: Google Analytics (GA4)
Different privacy and residency tradeoffs; not a sovereignty shortlist.
When: You need a free full-stack self-hosted analytics product with AGPL community edition
Consider: Plausible Analytics (CE) or other open full products in your shortlist
Pirsch open-sources the tracking core; on-prem of the full product is Enterprise-scoped.
When: You want the simplest possible privacy-first metrics with a Dutch vendor
Consider: Simple Analytics
Fewer advanced funnel/white-label features; different packaging tradeoffs.
When: You need heatmaps or session replay more than classical web analytics
Consider: Hotjar, Microsoft Clarity, or EU UX-analytics peers
Expect heavier consent and data-minimization review.
When: You must stay inside Google’s advertising and BigQuery measurement ecosystem
Consider: Google Analytics / Google Tag Manager stack
Opposite privacy and transfer posture—only if legal review accepts it.