Sitesights vs Tinylytics

Compare Sitesights and Tinylytics on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Fathom Analytics, Google Analytics, Microsoft Clarity

Sitesights

Germany· Web Analytics

Needs review

Shortlist Sitesights when you need German-operated cookieless web analytics with real-time dashboards, funnels, page flow, and a server-side API—especially agencies and SaaS teams that want Hetzner Germany hosting claims without running Matomo. Skip when you need public ISO/SOC audits, long-term visitor identity, session replay, or a fully published subprocessor pack; consider Plausible Analytics or self-hosted Matomo instead.

Cookieless trackingEU-operated (DE)Hetzner Germany (claimed)Server-side APIFunnels + page flowMulti-project / agencies

View listing Visit Website

Tinylytics

United Kingdom· Web Analytics

Needs review

Shortlist Tinylytics when you want cookieless page analytics plus bundled uptime/SSL/content checks for a handful of small sites, with primary data on Hetzner in Germany and founder support. Skip when you need self-host/open source, formal ISO/SOC packs, or enterprise multi-tenant governance—consider Plausible Analytics or Simple Analytics instead.

Cookieless analyticsPrimary host: Hetzner DEUptime + SSL monitoringBroken-link crawlsSaaS only (no self-host)Solo-founder UK

View listing Visit Website

Highlighted rows differ between the two products.

Sitesights vs Tinylytics: Snapshot
Feature	Sitesights	Tinylytics
Country of origin	Germany	United Kingdom
Category	Web Analytics	Web Analytics
Open source	No	No
Self-hosted	No	No
Headquarters	Germany	United Kingdom
Legal entity	Drude, Grossert GbR	Vincent Ritter Consulting (service brand; terms state not separately incorporated yet)
Governing law	Not listed	Not clearly stated as a single governing-law clause on the public terms page; confirm contractually
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
Hosting / residency	Product databases and app servers claimed in Germany on Hetzner. Marketing site uses Cloudflare (US) CDN. Payments via Paddle. Full product subprocessor/backup list not published on main site.	Primary analytics storage: Hetzner Falkenstein (Germany). CDN/security: Cloudflare. Error monitoring: Sentry.io. Payments: Paddle and Lemon Squeezy (Stripe company). Optional: IPinfo geo fallback for API hits; opt-in AI Insights via xAI and Google Gemini. No public backup-provider detail beyond that stack.
Summary	German cookieless web analytics SaaS with real-time dashboards, events, funnels, and server-side APIs. Operated by Drude, Grossert GbR; product data claimed on Hetzner in Germany.	Privacy-first cookieless web analytics for small sites, with bundled uptime/SSL checks, content monitoring, events, and founder support—hosted primarily on Hetzner in Germany.
Tags	analytics privacy gdpr api cookieless saas germany	analytics privacy gdpr api cookie-free uptime-monitoring indie

At a glance: Sitesights vs Tinylytics
At a glance	Sitesights	Tinylytics
HQ / entity	Drude, Grossert GbR, Germany	Not listed
Category	Web analytics (SaaS)	Not listed
Hosting (product)	Hetzner, Germany (vendor docs)	Not listed
Tracking model	Cookieless; 48h rotating server hash	Not listed
Open source	No (libs/plugins public; core SaaS proprietary)	Not listed
Commercial model	Free start; pageviews + events subscriptions (Paddle)	Paid site-count plans; short trial; no permanent free tier
HQ / operator	Not listed	Vincent Ritter Consulting, United Kingdom
Launched	Not listed	12 June 2023 (live counters on homepage)
Primary hosting	Not listed	Hetzner, Falkenstein, Germany
Deployment	Not listed	Managed SaaS only (not open source, not self-hosted)
Differentiators	Not listed	Analytics + uptime/SSL/content monitoring + widgets

Key capabilities: Sitesights vs Tinylytics
Key capabilities	Sitesights	Tinylytics
Cookieless tracking	Yes	Yes
EU-operated (DE)	Yes	Not listed
Hetzner Germany (claimed)	Yes	Not listed
Server-side API	Yes	Not listed
Funnels + page flow	Yes	Not listed
Multi-project / agencies	Yes	Not listed
Primary host: Hetzner DE	Not listed	Yes
Uptime + SSL monitoring	Not listed	Yes
Broken-link crawls	Not listed	Yes
SaaS only (no self-host)	Not listed	Yes
Solo-founder UK	Not listed	Yes

Sitesights

Cookieless 48-hour rotating session hash
Standard tracking does not set cookies. Sitesights generates a server-side salted hash from IP, User-Agent, and site id with a salt that rotates every 48 hours, so long-term cross-day visitor re-identification is intentionally broken. Useful when teams want essential traffic metrics without a cookie-consent banner solely for analytics—confirm legal basis with counsel for your jurisdiction and data fields (including geo).
Sub-1 KB client script plus WordPress and Shopify plugins
Drop-in client snippet marketed as under 1 KB, with official WordPress and Shopify integration paths for non-engineers. Fits marketing sites and stores that need quick instrumentation without a heavy tag manager stack.
Server-side REST API with C# and Node libraries
Send page views and events from your backend with API-key auth so ad blockers cannot strip the beacon. MIT-licensed C# and Node.js libraries on GitHub speed integration; keep API keys off the client. Preferred path for accuracy-critical SaaS and app backends.
Real-time overview with campaign and device filters
Live dashboard for visitors, pageviews, and sessions with advanced filters, UTM/campaign views, geo, browser, OS, screen size, and daytime patterns. Aimed at operators who want essential marketing analytics in one place rather than a full product-analytics suite.
Custom funnels and page-flow journey maps
Build multi-step funnels and visual page-flow maps to see entry paths, routes, and exits. Helps conversion and UX work without session replay. Depth is journey-oriented, not identity-graph product analytics.
Multi-project workspaces with roles for agencies
Group sites and apps into projects, assign roles/permissions, and invite clients or teammates. Marketing materials reference high ceilings for team seats and properties on paid plans—verify current limits on the official pricing page.

Tinylytics

Cookie-free unique hits with rotating salts
Page views and unique hits without tracking cookies or fingerprinting. Uniques combine truncated request signals with a 12-hour rotating salt and one-way hash, reset daily at midnight UTC; visitor IPs are not stored in hits. Suited to indie sites that want trendable uniques without consent banners for analytics cookies.
Thunder Clap uptime, SSL, and domain alerts
In-house multi-region health checks (default every 10 minutes) confirm downtime before emailing, plus SSL expiry notices and domain monitoring. Ultra can shorten intervals. Replaces a separate uptime tool for small fleets—but false downs can occur if WAFs block the Tinylytics monitor user-agent.
Daily content crawl for broken links and mixed content
Subscribed sites can crawl up to 50 pages (two levels deep) on a daily cadence, flagging broken links and mixed HTTP assets on HTTPS pages, with ignore lists and re-check. Ultra adds optional AI spell-check on visible copy—keep it off if AI subprocessors are out of policy.
Attribute-based event tracking (beta)
Enable events on the embed script and mark elements with data-tinylytics-event using category.action names (optional values for downloads). No GTM required; beacon mode helps navigations. Still beta—expect API/schema changes and incomplete capture under aggressive blockers.
Public stats, kudos, hit counters, API, and webhooks
Share passcode-protected public stats, embed hit counters and kudos buttons, export CSV, call the documented API, and push signed webhooks for visits, events, and monitoring. Built for transparent blogs and light automation rather than enterprise BI warehouses.

Assurance & compliance: Sitesights vs Tinylytics
Assurance & compliance	Sitesights	Tinylytics
Independent security / no-logs audit	Not found No public third-party security or no-logs audit PDF located on the official site or docs.	Not found No public third-party security or no-logs audit report found on official docs.
ISO 27001	Not found No public ISO 27001 certificate found on official pages.	Not found No ISO 27001 claim found on privacy, compliance, or hosting pages.
SOC 2 / SOC 3	Not found No public SOC 2/3 report found on official pages.	Not found No SOC 2/3 report or claim found on public site.
GDPR / EU data protection	Vendor claimed German controller (Drude, Grossert GbR); cookieless hashing and EU hosting claims in docs/privacy. Confirm DPA and legal basis for IP/geo with counsel.	Vendor claimed Vendor documents GDPR-oriented design (cookieless, data minimisation, EU primary host, deletion). Not independent certification.
US CLOUD Act exposure (indicative)	Partial EU entity / no known US parent; product hosting claimed on Hetzner Germany. Marketing site lists Cloudflare (US); payments via Paddle; full SaaS subprocessor list not public. Indicative only—not legal advice.	Partial UK operator, no known US parent, primary host Hetzner DE; partial exposure via Cloudflare, Sentry, Lemon Squeezy/Paddle, optional IPinfo and opt-in US AI APIs. Not legal advice.
Data processing agreement (B2B)	Not found No standalone public DPA download found during research; request under contract for B2B processing.	Not found No public DPA/downloadable processor agreement found; ask the vendor before B2B rollout.
EU AI Act	Not applicable Web analytics product; not marketed as an AI system under the EU AI Act.	Not applicable Core product is analytics/monitoring; optional AI insights are secondary and opt-in.

Considerations & known limitations: Sitesights vs Tinylytics
Considerations & known limitations	Sitesights	Tinylytics
No public independent security audit	Medium ISO 27001, SOC 2, and third-party security audits were not found on public pages. Enterprises may need to commission questionnaires or wait for vendor artifacts under NDA.	Not listed
Incomplete public subprocessor list	Medium Hetzner (product) and Cloudflare (marketing site) are documented; backups, email, support, and monitoring vendors for the SaaS are not fully listed. Ask for a current subprocessor annex.	Not listed
US-group CDN on marketing site	Low Privacy policy lists Cloudflare Inc. (US) for the public website CDN. Separate from claimed Hetzner product data path, but relevant to overall vendor surface area.	Not listed
48-hour hash limits long-term visitor analytics	Low By design, the rotating salt prevents durable cross-day visitor recognition. Teams needing retention cohorts or multi-week funnels by person must model events differently or choose product-analytics tools.	Not listed
On-premise availability is marketing-only detail	Low About page claims on-prem hosting; docs do not provide a self-serve install guide. Treat as sales-assisted until scope is confirmed in writing.	Not listed
US-group subprocessors on the data path	Not listed	Medium Cloudflare, Sentry, payment processors (incl. Lemon Squeezy/Stripe group), optional IPinfo and opt-in xAI/Gemini mean the stack is not EU-only end-to-end despite Hetzner primary storage.
Solo-founder operational concentration	Not listed	Medium Service is provided by Vincent Ritter Consulting / a solo developer. Support is personal and fast for indies, but bus-factor and formal SLA expectations differ from larger vendors.
No public ISO/SOC/audit or DPA pack	Not listed	Medium Enterprise security questionnaires will hit gaps until the vendor supplies audits and a B2B DPA under NDA or email.
Scale and feature boundaries	Not listed	Low Content crawls are depth/page limited; event tracking is beta; fair-usage applies to extreme hit volumes; no self-host escape hatch.
Optional AI shares aggregated analytics	Not listed	Low AI Insights and related AI spell-check are opt-in and send aggregated (not visitor PII per vendor) data to third-party AI providers—leave disabled under strict AI policies.

Fit

Sitesights

Best fit when

EU teams replacing GA4 with cookieless SaaS and wanting funnels/page-flow beyond a bare traffic counter
Agencies and freelancers managing many client sites with projects and role-based invites
Engineering-led installs that prefer server-side pageview/event ingestion against ad blockers
WordPress or Shopify properties that want official plugin paths plus a light client script
Orgs that value a German GbR legal entity and Hetzner Germany hosting claims over US multi-region analytics

Poor fit when

Product analytics requiring long-term user identity, cross-device stitching, or CDP-style profiles (48h hash by design)
Buyers who need public ISO 27001, SOC 2, or independent audit PDFs before shortlist
Teams that require self-serve open-source self-host as the primary deployment (on-prem only claimed, not documented as OSS)
UX research needs for heatmaps or session replay
Procurement that requires a complete public subprocessor list without an NDA conversation

Consider instead when

When: You want a minimal EU cookieless SaaS or a well-known self-host option
Consider: Plausible Analytics
Simpler metric set; strong self-host story. Sitesights markets deeper funnels/page-flow and multi-project agency features.
When: You need full self-host control, on-prem by default, or mature open-source governance
Consider: Matomo (self-hosted)
Heavier stack, deeper feature surface, and you operate the data plane yourself.
When: You need identity-rich product analytics, retention cohorts, or event warehouses
Consider: Mixpanel or similar product-analytics platforms
Different category—Sitesights is website/app growth analytics, not a full product analytics suite.
When: You need heatmaps, recordings, or UX feedback loops
Consider: Hotjar, Microsoft Clarity, or EU UX-analytics tools
Sitesights focuses on traffic, events, funnels, and flows—not session replay.

Tinylytics

Best fit when

Indie blogs, portfolios, and side projects that want simple cookieless stats without Google Analytics
Small sites that also want uptime, SSL expiry, and broken-link checks in the same tool
Operators who prefer founder-answered support and lightweight embeds over enterprise marketing stacks
Teams OK with managed EU primary hosting and willing to review named US-group subprocessors (CDN, payments, optional AI)
Agencies managing a modest number of client sites with public stats or kudos-style engagement widgets

Poor fit when

Orgs that require self-hosted collectors or open-source audit of the full analytics stack
Procurement needing published ISO 27001, SOC 2, independent audits, or a downloadable DPA out of the box
Very high-traffic properties needing contractual capacity/SLA commitments beyond fair-usage conversation
Policies that ban Cloudflare/Sentry/US payment or optional US AI APIs on any data path
Teams that need session replay, heatmaps, or deep advertising attribution (Clarity/GA territory)

Consider instead when

When: You need open-source and optional self-hosting of the analytics stack
Consider: Plausible Analytics
Estonian product with Cloud plus Community Edition self-host; less bundling of uptime/content monitors.
When: You want European cookieless analytics with a simpler analytics-only scope
Consider: Simple Analytics
Strong privacy positioning; compare feature depth and monitoring separately.
When: You need free-at-scale marketing analytics, ads integrations, or attribution depth
Consider: Google Analytics (incumbent) — or stay on a privacy tool if GA is disallowed
Different privacy and sovereignty profile entirely.
When: You need session replay or heatmaps and accept that privacy model
Consider: Microsoft Clarity or specialised replay tools
Tinylytics deliberately avoids fingerprinting-style session products.

Open questions for due diligence

Sitesights

Will the vendor sign a B2B DPA and provide a complete subprocessor list (backups, email, support, monitoring)?
Is the Hetzner Germany residency contractual for all analytics tenant data, including DR/backups?
What is the formal on-premise offering (SLA, update model, supported regions) versus SaaS-only?
Are any ISO 27001 / SOC 2 / penetration-test reports available under NDA?
How should geolocation fields and IP hashing be assessed under your counsel's GDPR legal-basis analysis?

Tinylytics

Will Vincent Ritter Consulting sign a GDPR Article 28 DPA and provide a current subprocessor list under contract?
Are backups/DR and email delivery fully covered by the named providers, or are there additional hosts?
Is there any roadmap for independent security review, SOC 2, or ISO 27001?
What contractual terms apply for accounts consistently above the fair-usage hit threshold?
For AI Insights: exact retention, regions, and processor terms at xAI and Google for the paid API plans used?