Publytics vs Tinylytics

Compare Publytics and Tinylytics on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Fathom Analytics, Google Analytics

Publytics

Italy· Web Analytics

Needs review

Shortlist when you need cookieless, unsampled publisher analytics with multi-site Network views and a public EU DPA from an Italian SaaS operator. Skip when you need self-hosting, product analytics at GA4/Adobe depth, or product-level ISO/SOC—consider Plausible (simpler privacy analytics / self-host options) or Matomo (self-host ownership) instead.

Cookieless trackingNo default samplingMulti-site NetworkEU-hosted (EuroVPS/Hetzner)Public B2B DPAPublisher-focused UX

View listing Visit Website

Tinylytics

United Kingdom· Web Analytics

Needs review

Shortlist Tinylytics when you want cookieless page analytics plus bundled uptime/SSL/content checks for a handful of small sites, with primary data on Hetzner in Germany and founder support. Skip when you need self-host/open source, formal ISO/SOC packs, or enterprise multi-tenant governance—consider Plausible Analytics or Simple Analytics instead.

Cookieless analyticsPrimary host: Hetzner DEUptime + SSL monitoringBroken-link crawlsSaaS only (no self-host)Solo-founder UK

View listing Visit Website

Highlighted rows differ between the two products.

Publytics vs Tinylytics: Snapshot
Feature	Publytics	Tinylytics
Country of origin	Italy	United Kingdom
Category	Web Analytics	Web Analytics
Open source	No	No
Self-hosted	No	No
Headquarters	Italy	United Kingdom
Legal entity	Publytics S.r.l. / Publytics SRL, Via Val Leventina 3 INT 1, 20148 Milan (MI), Italy (VAT IT13079420967)	Vincent Ritter Consulting (service brand; terms state not separately incorporated yet)
Governing law	Italy / EU GDPR (processor under published DPA)	Not clearly stated as a single governing-law clause on the public terms page; confirm contractually
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Medium
Hosting / residency	Analytics infrastructure subprocessors in public DPA: EuroVPS (Euclid Services Ltd, Cyprus) and Hetzner Online GmbH (Germany). Data policy/DPA: EU storage (NL, DE, FI; DPA also IT); no transfer outside the EU for analytics processing. Account path: Stripe (payments), Brevo/Sendinblue (email).	Primary analytics storage: Hetzner Falkenstein (Germany). CDN/security: Cloudflare. Error monitoring: Sentry.io. Payments: Paddle and Lemon Squeezy (Stripe company). Optional: IPinfo geo fallback for API hits; opt-in AI Insights via xAI and Google Gemini. No public backup-provider detail beyond that stack.
Summary	Cookieless web analytics SaaS for digital publishers: unsampled real-time and historical metrics, multi-site Network views, GA import, and EU-hosted measurement from an Italian company.	Privacy-first cookieless web analytics for small sites, with bundled uptime/SSL checks, content monitoring, events, and founder support—hosted primarily on Hetzner in Germany.
Tags	privacy gdpr web-analytics cookieless publishers real-time	privacy gdpr analytics cookie-free uptime-monitoring indie api

At a glance: Publytics vs Tinylytics
At a glance	Publytics	Tinylytics
HQ	Milan, Italy	Not listed
Legal entity	Publytics S.r.l. (VAT IT13079420967)	Not listed
Hosting	EuroVPS + Hetzner (EU regions)	Not listed
Deployment	Managed SaaS (not self-hosted)	Managed SaaS only (not open source, not self-hosted)
Commercial model	Pageview tiers; free trial	Paid site-count plans; short trial; no permanent free tier
Open source	No (tracker uses MIT library code)	Not listed
HQ / operator	Not listed	Vincent Ritter Consulting, United Kingdom
Launched	Not listed	12 June 2023 (live counters on homepage)
Primary hosting	Not listed	Hetzner, Falkenstein, Germany
Differentiators	Not listed	Analytics + uptime/SSL/content monitoring + widgets

Key capabilities: Publytics vs Tinylytics
Key capabilities	Publytics	Tinylytics
Cookieless tracking	Yes	Yes
No default sampling	Yes	Not listed
Multi-site Network	Yes	Not listed
EU-hosted (EuroVPS/Hetzner)	Yes	Not listed
Public B2B DPA	Yes	Not listed
Publisher-focused UX	Yes	Not listed
Primary host: Hetzner DE	Not listed	Yes
Uptime + SSL monitoring	Not listed	Yes
Broken-link crawls	Not listed	Yes
SaaS only (no self-host)	Not listed	Yes
Solo-founder UK	Not listed	Yes

Publytics

Unsampled real-time and daily publisher metrics
Dashboard and Real-time views show active users (including last-minute and 30-minute windows), top pages, sources, social referrals, and day trends—with minute-level trend comparison documented for real-time. Vendor states no default data sampling, so reports reflect full counted client-side traffic rather than GA-style estimates on large properties.
Multi-site Network mode for content portfolios
Business and Enterprise plans can group properties into Networks (plan caps apply: e.g. up to three Networks on Business, unlimited on Enterprise). Network views mirror site dashboards with split-by-site filters, combined real-time tables, and PDF/CSV export across the portfolio—built for multi-brand publishers rather than single blogs.
Cookieless measurement with daily-rotating visitor hash
Tracking avoids cookies and permanent device IDs. Per the DPA, IP and User-Agent are used only to derive a daily salted hash for unique visitors, then discarded; metrics stay aggregated (URL, referrer, browser/OS, device, country). Designed so many sites can skip consent banners for analytics alone—confirm with counsel for your jurisdictions and any custom IDs you add.
Historical import, custom events/dimensions, and API
Import paths cover GA4 and other tools (Plausible/Fathom mentioned) with support-assisted finalization. Custom events, dimensions, and metrics scale by plan; REST API uses Sanctum Bearer tokens scoped to subscribed sites. Fits teams rebuilding GA-era reporting without rebuilding infrastructure.
AI referral traffic reporting
Dedicated documentation for traffic referred from AI systems (ChatGPT, Gemini, Claude, Perplexity, Copilot, Mistral, Google AI Overviews, Deepseek, and others). Useful for publishers optimizing for answer-engine and AI-overview discovery alongside classic SEO sources.

Tinylytics

Cookie-free unique hits with rotating salts
Page views and unique hits without tracking cookies or fingerprinting. Uniques combine truncated request signals with a 12-hour rotating salt and one-way hash, reset daily at midnight UTC; visitor IPs are not stored in hits. Suited to indie sites that want trendable uniques without consent banners for analytics cookies.
Thunder Clap uptime, SSL, and domain alerts
In-house multi-region health checks (default every 10 minutes) confirm downtime before emailing, plus SSL expiry notices and domain monitoring. Ultra can shorten intervals. Replaces a separate uptime tool for small fleets—but false downs can occur if WAFs block the Tinylytics monitor user-agent.
Daily content crawl for broken links and mixed content
Subscribed sites can crawl up to 50 pages (two levels deep) on a daily cadence, flagging broken links and mixed HTTP assets on HTTPS pages, with ignore lists and re-check. Ultra adds optional AI spell-check on visible copy—keep it off if AI subprocessors are out of policy.
Attribute-based event tracking (beta)
Enable events on the embed script and mark elements with data-tinylytics-event using category.action names (optional values for downloads). No GTM required; beacon mode helps navigations. Still beta—expect API/schema changes and incomplete capture under aggressive blockers.
Public stats, kudos, hit counters, API, and webhooks
Share passcode-protected public stats, embed hit counters and kudos buttons, export CSV, call the documented API, and push signed webhooks for visits, events, and monitoring. Built for transparent blogs and light automation rather than enterprise BI warehouses.

Assurance & compliance: Publytics vs Tinylytics
Assurance & compliance	Publytics	Tinylytics
Independent security / no-logs audit	Not found Searched official site; no public third-party security or no-logs audit PDF found. DPA describes hashing and non-retention of raw IP/UA.	Not found No public third-party security or no-logs audit report found on official docs.
ISO 27001	Not found No Publytics product certificate found. Host EuroVPS markets ISO certifications; that is infrastructure provider scope, not Publytics certification.	Not found No ISO 27001 claim found on privacy, compliance, or hosting pages.
SOC 2 / SOC 3	Not found No public SOC 2/3 report found on official Publytics pages.	Not found No SOC 2/3 report or claim found on public site.
GDPR / EU data protection	Vendor claimed Italian controller/processor entity; cookieless design; public Art. 28 DPA; EU hosting named. Not legal advice.	Vendor claimed Vendor documents GDPR-oriented design (cookieless, data minimisation, EU primary host, deletion). Not independent certification.
US CLOUD Act exposure (indicative)	Partial EU entity, no known US parent; analytics hosts EuroVPS + Hetzner in EU with DPA no third-country transfer for service data. Account billing via Stripe (US company). Not a vendor 'safe' claim—EuropeanStack assessment only.	Partial UK operator, no known US parent, primary host Hetzner DE; partial exposure via Cloudflare, Sentry, Lemon Squeezy/Paddle, optional IPinfo and opt-in US AI APIs. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Full public DPA at https://publytics.net/dpa with Annex B subprocessors and Annex C security/transfer instructions.	Not found No public DPA/downloadable processor agreement found; ask the vendor before B2B rollout.
EU AI Act	Not applicable Web analytics product; AI-referral reporting is measurement of referrers, not an AI system product.	Not applicable Core product is analytics/monitoring; optional AI insights are secondary and opt-in.

Considerations & known limitations: Publytics vs Tinylytics
Considerations & known limitations	Publytics	Tinylytics
SaaS-only (no self-host)	Medium All measurement depends on Publytics cloud availability and vendor roadmap. Teams with residency or air-gap requirements need Matomo/Plausible CE-style self-host alternatives.	Not listed
No public independent security audit	Medium Hashing and non-retention claims are first-party (DPA/docs). No public third-party audit was found—enterprise security reviews will need questionnaires, DPA audit rights, and possibly NDA materials.	Not listed
Feature depth tied to pageview tiers	Low Networks, API rate limits, custom dimensions/metrics, retention years, and time granularity differ by Lite/Business/Enterprise. Validate limits against portfolio size before migration.	Not listed
US payment processor on account path	Low Stripe processes payments (US company). Separate from DPA Annex B analytics hosts, but relevant if procurement treats all vendor SaaS touchpoints as in-scope for CLOUD Act diligence.	Not listed
Customer-injected identifiers can re-identify	Medium DPA warns controllers not to inject unique user IDs that re-identify visitors via the script. Misconfiguration can undermine the cookieless privacy model.	Not listed
US-group subprocessors on the data path	Not listed	Medium Cloudflare, Sentry, payment processors (incl. Lemon Squeezy/Stripe group), optional IPinfo and opt-in xAI/Gemini mean the stack is not EU-only end-to-end despite Hetzner primary storage.
Solo-founder operational concentration	Not listed	Medium Service is provided by Vincent Ritter Consulting / a solo developer. Support is personal and fast for indies, but bus-factor and formal SLA expectations differ from larger vendors.
No public ISO/SOC/audit or DPA pack	Not listed	Medium Enterprise security questionnaires will hit gaps until the vendor supplies audits and a B2B DPA under NDA or email.
Scale and feature boundaries	Not listed	Low Content crawls are depth/page limited; event tracking is beta; fair-usage applies to extreme hit volumes; no self-host escape hatch.
Optional AI shares aggregated analytics	Not listed	Low AI Insights and related AI spell-check are opt-in and send aggregated (not visitor PII per vendor) data to third-party AI providers—leave disabled under strict AI policies.

Fit

Publytics

Best fit when

Content publishers and media sites that want GA3-style reporting without cookies or default sampling
Multi-brand portfolios that need Network dashboards, split-by-site filters, and shared exports
Teams migrating historical series from GA4 (or Plausible/Fathom) into a privacy-oriented SaaS
EU-oriented controllers who want Italian legal entity, published DPA, and EU infrastructure subprocessors named in annexes
Editorial/SEO leads who need real-time active users, sources, and AI-referral reporting without operating self-hosted analytics

Poor fit when

Organizations that require self-hosted or open-source analytics only
Product/growth teams that need GA4/Adobe-class event modeling, experiment stacks, and ads ecosystem integrations
Buyers that need verified product ISO 27001/SOC 2 certificates before shortlist (none found for Publytics itself)
Very simple single-site blogs that only need minimal privacy metrics—lighter tools may be enough

Consider instead when

When: You want open-core privacy analytics with optional self-host
Consider: Plausible Analytics
Simpler surface; stronger self-host/open-core path than Publytics SaaS-only model
When: You must run analytics on your own infrastructure
Consider: Matomo (self-host) or Plausible Community Edition
Publytics is managed cloud only—no official on-prem product
When: You need deep product analytics and marketing stack integration
Consider: Google Analytics or Adobe Analytics
Trade privacy/EU-hosting priorities for ecosystem breadth

Tinylytics

Best fit when

Indie blogs, portfolios, and side projects that want simple cookieless stats without Google Analytics
Small sites that also want uptime, SSL expiry, and broken-link checks in the same tool
Operators who prefer founder-answered support and lightweight embeds over enterprise marketing stacks
Teams OK with managed EU primary hosting and willing to review named US-group subprocessors (CDN, payments, optional AI)
Agencies managing a modest number of client sites with public stats or kudos-style engagement widgets

Poor fit when

Orgs that require self-hosted collectors or open-source audit of the full analytics stack
Procurement needing published ISO 27001, SOC 2, independent audits, or a downloadable DPA out of the box
Very high-traffic properties needing contractual capacity/SLA commitments beyond fair-usage conversation
Policies that ban Cloudflare/Sentry/US payment or optional US AI APIs on any data path
Teams that need session replay, heatmaps, or deep advertising attribution (Clarity/GA territory)

Consider instead when

When: You need open-source and optional self-hosting of the analytics stack
Consider: Plausible Analytics
Estonian product with Cloud plus Community Edition self-host; less bundling of uptime/content monitors.
When: You want European cookieless analytics with a simpler analytics-only scope
Consider: Simple Analytics
Strong privacy positioning; compare feature depth and monitoring separately.
When: You need free-at-scale marketing analytics, ads integrations, or attribution depth
Consider: Google Analytics (incumbent) — or stay on a privacy tool if GA is disallowed
Different privacy and sovereignty profile entirely.
When: You need session replay or heatmaps and accept that privacy model
Consider: Microsoft Clarity or specialised replay tools
Tinylytics deliberately avoids fingerprinting-style session products.

Open questions for due diligence

Publytics

Will Publytics provide completed security questionnaire, pen-test summary, or ISO evidence under NDA for enterprise procurement?
Exact current pageview tier limits, Network caps, and retention for the sites you will migrate?
Is GA4 historical import complete for your property structure (events, custom dimensions) or only core traffic series?
How are subprocessors for account services (Stripe, Brevo) contractually covered relative to the analytics DPA annex?
Any planned US or non-EU hosting options that would change the current EU-only transfer instruction?

Tinylytics

Will Vincent Ritter Consulting sign a GDPR Article 28 DPA and provide a current subprocessor list under contract?
Are backups/DR and email delivery fully covered by the named providers, or are there additional hosts?
Is there any roadmap for independent security review, SOC 2, or ISO 27001?
What contractual terms apply for accounts consistently above the fair-usage hit threshold?
For AI Insights: exact retention, regions, and processor terms at xAI and Google for the paid API plans used?