Swetrix vs Tinylytics

Compare Swetrix and Tinylytics on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Fathom Analytics, Google Analytics

Swetrix

United Kingdom· Web Analytics

Needs review

Shortlist Swetrix when you want cookieless traffic plus product-oriented tools (funnels, RUM, errors, optional Cloud replays) under a UK company with Hetzner DE hosting and AGPLv3 self-host CE. Skip when you need public ISO/SOC packs, zero US-group subprocessors, multi-year cookie retention cohorts, or free forever hosted analytics—consider Plausible Analytics or Simple Analytics for minimal traffic-only privacy analytics, or Matomo for heavyweight self-host control.

Cookieless trackingHetzner DE hostingOpen source (AGPLv3)Self-host CEFunnels + errors + RUMPublic DPA

View listing Visit Website

Tinylytics

United Kingdom· Web Analytics

Needs review

Shortlist Tinylytics when you want cookieless page analytics plus bundled uptime/SSL/content checks for a handful of small sites, with primary data on Hetzner in Germany and founder support. Skip when you need self-host/open source, formal ISO/SOC packs, or enterprise multi-tenant governance—consider Plausible Analytics or Simple Analytics instead.

Cookieless analyticsPrimary host: Hetzner DEUptime + SSL monitoringBroken-link crawlsSaaS only (no self-host)Solo-founder UK

View listing Visit Website

Highlighted rows differ between the two products.

Swetrix vs Tinylytics: Snapshot
Feature	Swetrix	Tinylytics
Country of origin	United Kingdom	United Kingdom
Category	Web Analytics	Web Analytics
Open source	Yes	No
Self-hosted	Yes	No
Headquarters	United Kingdom	United Kingdom
Legal entity	Swetrix Ltd (SC797389), Edinburgh, Scotland	Vincent Ritter Consulting (service brand; terms state not separately incorporated yet)
Governing law	Not listed	Not clearly stated as a single governing-law clause on the public terms page; confirm contractually
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
Hosting / residency	Cloud analytics data: Hetzner Online GmbH (Germany) per DPA/Data Policy. End User error monitoring sub-processor: Sentry / Functional Software Inc. (United States). Customer-side Privacy Policy list also includes Paddle (UK payments), Fastmail (Australia business email), AWS (US transactional/marketing email), OpenRouter (US optional AI chat). No known US parent.	Primary analytics storage: Hetzner Falkenstein (Germany). CDN/security: Cloudflare. Error monitoring: Sentry.io. Payments: Paddle and Lemon Squeezy (Stripe company). Optional: IPinfo geo fallback for API hits; opt-in AI Insights via xAI and Google Gemini. No public backup-provider detail beyond that stack.
Summary	Cookieless, privacy-first web analytics from a UK company: traffic, funnels, errors, and performance on Hetzner in Germany, with AGPLv3 self-host Community Edition and optional Cloud session replays.	Privacy-first cookieless web analytics for small sites, with bundled uptime/SSL checks, content monitoring, events, and founder support—hosted primarily on Hetzner in Germany.
Tags	analytics privacy gdpr cookieless open-source self-host product-analytics	analytics privacy gdpr cookie-free uptime-monitoring indie api

At a glance: Swetrix vs Tinylytics
At a glance	Swetrix	Tinylytics
HQ	Edinburgh, United Kingdom	Not listed
Legal entity	Swetrix Ltd (SC797389)	Not listed
Governing law	Scotland (Terms)	Not listed
Primary hosting	Hetzner Online GmbH, Germany	Hetzner, Falkenstein, Germany
License	AGPLv3 (Community Edition)	Not listed
Commercial model	Event-volume Cloud subscription; free self-host CE; timed trial	Paid site-count plans; short trial; no permanent free tier
Open source	Yes — github.com/Swetrix/swetrix	Not listed
HQ / operator	Not listed	Vincent Ritter Consulting, United Kingdom
Launched	Not listed	12 June 2023 (live counters on homepage)
Deployment	Not listed	Managed SaaS only (not open source, not self-hosted)
Differentiators	Not listed	Analytics + uptime/SSL/content monitoring + widgets

Key capabilities: Swetrix vs Tinylytics
Key capabilities	Swetrix	Tinylytics
Cookieless tracking	Yes	Yes
Hetzner DE hosting	Yes	Not listed
Open source (AGPLv3)	Yes	Not listed
Self-host CE	Yes	Not listed
Funnels + errors + RUM	Yes	Not listed
Public DPA	Yes	Not listed
Primary host: Hetzner DE	Not listed	Yes
Uptime + SSL monitoring	Not listed	Yes
Broken-link crawls	Not listed	Yes
SaaS only (no self-host)	Not listed	Yes
Solo-founder UK	Not listed	Yes

Swetrix

Cookieless traffic analytics with hashed sessions
Lightweight script captures pageviews, referrers/UTMs, devices, and city-level geo without cookies or client-side storage. Per the Data Policy, IP and User-Agent are hashed in memory with a daily rotating salt; only a random session id is stored—so you get sessions without long-term cross-day visitor retention.
Funnels, custom events, and goals
Instrument signups, purchases, and other conversions as custom events; build multi-step funnels and goals in the dashboard. Useful for product and growth teams who need drop-off analysis without bolting on a second product-analytics SaaS.
Real-user performance and client error tracking
Records Web Performance API timings (TTFB, DNS, TLS, render, full page load) and optional JavaScript errors with stack/context by page and browser. Bridges marketing traffic views with engineering signals that pure pageview tools omit.
Opt-in Cloud session replays with privacy modes
Cloud projects can call startSessionReplay() to record DOM and interactions; default modes mask text/inputs. Replays are not created by ordinary pageviews—customers must enable them and own consent, masking, and page exclusions. Cloud-only versus Community Edition.
AGPLv3 open source with Docker self-host CE
Core platform is public on GitHub under GNU AGPLv3; Community Edition deploys via official Docker docs with MySQL, ClickHouse, and Redis. CE includes core analytics, events, sessions, funnels, performance, and errors—but not all Cloud extras (replays, some alerts/org/AI features).
Alerts, API, GA import, and team access
Configure alerts to email, Slack, Telegram, Discord, webhooks, or push; pull or push data via the API; import GA4 history; invite organisations with roles or share password-protected/public dashboards. Fits agencies and multi-site operators who outgrow single-user tools.

Tinylytics

Cookie-free unique hits with rotating salts
Page views and unique hits without tracking cookies or fingerprinting. Uniques combine truncated request signals with a 12-hour rotating salt and one-way hash, reset daily at midnight UTC; visitor IPs are not stored in hits. Suited to indie sites that want trendable uniques without consent banners for analytics cookies.
Thunder Clap uptime, SSL, and domain alerts
In-house multi-region health checks (default every 10 minutes) confirm downtime before emailing, plus SSL expiry notices and domain monitoring. Ultra can shorten intervals. Replaces a separate uptime tool for small fleets—but false downs can occur if WAFs block the Tinylytics monitor user-agent.
Daily content crawl for broken links and mixed content
Subscribed sites can crawl up to 50 pages (two levels deep) on a daily cadence, flagging broken links and mixed HTTP assets on HTTPS pages, with ignore lists and re-check. Ultra adds optional AI spell-check on visible copy—keep it off if AI subprocessors are out of policy.
Attribute-based event tracking (beta)
Enable events on the embed script and mark elements with data-tinylytics-event using category.action names (optional values for downloads). No GTM required; beacon mode helps navigations. Still beta—expect API/schema changes and incomplete capture under aggressive blockers.
Public stats, kudos, hit counters, API, and webhooks
Share passcode-protected public stats, embed hit counters and kudos buttons, export CSV, call the documented API, and push signed webhooks for visits, events, and monitoring. Built for transparent blogs and light automation rather than enterprise BI warehouses.

Assurance & compliance: Swetrix vs Tinylytics
Assurance & compliance	Swetrix	Tinylytics
Independent security / no-logs audit	Not found Searched marketing, DPA, privacy, and data policy; no public independent audit PDF located. Open-source code is available for review.	Not found No public third-party security or no-logs audit report found on official docs.
ISO 27001	Not found No public ISO 27001 certification claim found on primary pages.	Not found No ISO 27001 claim found on privacy, compliance, or hosting pages.
SOC 2 / SOC 3	Not found No public SOC 2/3 report found.	Not found No SOC 2/3 report or claim found on public site.
GDPR / EU data protection	Vendor claimed UK company; public GDPR/PECR discussion in Data Policy; cookieless design with non-stored IPs for standard analytics; Hetzner DE hosting; public DPA. Optional replays may be personal data depending on configuration—customer assesses legal basis.	Vendor claimed Vendor documents GDPR-oriented design (cookieless, data minimisation, EU primary host, deletion). Not independent certification.
US CLOUD Act exposure (indicative)	Partial No known US parent; primary analytics on Hetzner DE. Material exception: Sentry (US) processes End User error data per DPA; Privacy Policy also lists AWS and OpenRouter (US) for customer email/AI. Indicative medium exposure—not a clean bill. Not legal advice.	Partial UK operator, no known US parent, primary host Hetzner DE; partial exposure via Cloudflare, Sentry, Lemon Squeezy/Paddle, optional IPinfo and opt-in US AI APIs. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Public DPA at swetrix.com/dpa incorporated by Terms; acceptance by use of Service; signed copy on request.	Not found No public DPA/downloadable processor agreement found; ask the vendor before B2B rollout.
EU AI Act	Not applicable Core product is web analytics, not an AI system. Optional Ask AI / OpenRouter is ancillary; confirm if your deployment enables it.	Not applicable Core product is analytics/monitoring; optional AI insights are secondary and opt-in.

Considerations & known limitations: Swetrix vs Tinylytics
Considerations & known limitations	Swetrix	Tinylytics
US-group subprocessors (Sentry, AWS, OpenRouter)	Medium Primary analytics hosting is Hetzner DE, but Sentry (US) is an End User error-tracking sub-processor on the DPA, and AWS/OpenRouter appear for customer email/AI. Orgs with strict no-US-cloud rules need explicit acceptance or self-host CE to avoid those paths.	Medium Cloudflare, Sentry, payment processors (incl. Lemon Squeezy/Stripe group), optional IPinfo and opt-in xAI/Gemini mean the stack is not EU-only end-to-end despite Hetzner primary storage.
Session replay is opt-in and controller-owned	Medium Cloud replays can capture DOM and inputs unless masked. Customers must enable startSessionReplay(), configure privacy modes/exclusions, and provide notices/consent where required—misconfiguration can reintroduce personal data risk that standard cookieless pageviews avoid.	Not listed
No public ISO/SOC or third-party audit	Medium Assurance relies on first-party policies, Hetzner infrastructure claims, and open source. Enterprise questionnaires that hard-gate on certs will stall until materials are provided under NDA or produced.	Not listed
Cloud vs Community Edition feature gap	Low Self-host CE is free and covers core analytics, but replays and several Cloud growth/ops features are limited or Cloud-only. Budget and feature planning must not assume feature parity.	Not listed
Daily salt rotation limits retention metrics	Low Cookieless design deliberately prevents classic multi-day visitor retention. Teams that need that metric class need another product or consented identity.	Not listed
Solo-founder operational concentration	Not listed	Medium Service is provided by Vincent Ritter Consulting / a solo developer. Support is personal and fast for indies, but bus-factor and formal SLA expectations differ from larger vendors.
No public ISO/SOC/audit or DPA pack	Not listed	Medium Enterprise security questionnaires will hit gaps until the vendor supplies audits and a B2B DPA under NDA or email.
Scale and feature boundaries	Not listed	Low Content crawls are depth/page limited; event tracking is beta; fair-usage applies to extreme hit volumes; no self-host escape hatch.
Optional AI shares aggregated analytics	Not listed	Low AI Insights and related AI spell-check are opt-in and send aggregated (not visitor PII per vendor) data to third-party AI providers—leave disabled under strict AI policies.

Fit

Swetrix

Best fit when

SMEs, agencies, and product teams replacing GA4 who need cookieless traffic stats without a cookie banner driven only by analytics
Engineering-minded buyers who want error tracking and real-user performance in the same privacy-first dashboard as pageviews
Teams that may enable Cloud session replays later but can treat them as explicit opt-in with their own legal basis
Operators willing to run Docker Community Edition (MySQL/ClickHouse/Redis) when Cloud commercial terms or feature limits do not fit
Buyers who need a public B2B DPA, API access, GA4 import, and multi-channel alerts under a UK legal entity

Poor fit when

Enterprises that require published ISO 27001 / SOC 2 certificates or independent audit PDFs before shortlist
Policies that forbid any US-group subprocessors (Sentry is listed for End User error data; AWS/OpenRouter appear for customer services)
Use cases that depend on long-term cookie-based retention or cross-device identity graphs
Buyers who only want free hosted analytics with no paid Cloud tier and no self-host operations burden
Sites that will run session replays on sensitive flows without capacity to configure masking, exclusions, and consent

Consider instead when

When: You only need minimal cookieless pageviews/referrers with the smallest possible product surface
Consider: Plausible Analytics or Simple Analytics
Swetrix adds funnels, errors, RUM, and Cloud replays; peers stay closer to pure traffic analytics.
When: You need deep on-prem control, plugins, and mature enterprise self-host packaging
Consider: Matomo (self-host or managed EU hosts such as Matomo by Stackhero)
Heavier ops and optional cookies; stronger fit for large controlled deployments.
When: You must stay inside Google advertising measurement and free GA4 ecosystem tooling
Consider: Google Analytics
Trade privacy, consent, and transfer complexity for ads integration and zero software fee.

Tinylytics

Best fit when

Indie blogs, portfolios, and side projects that want simple cookieless stats without Google Analytics
Small sites that also want uptime, SSL expiry, and broken-link checks in the same tool
Operators who prefer founder-answered support and lightweight embeds over enterprise marketing stacks
Teams OK with managed EU primary hosting and willing to review named US-group subprocessors (CDN, payments, optional AI)
Agencies managing a modest number of client sites with public stats or kudos-style engagement widgets

Poor fit when

Orgs that require self-hosted collectors or open-source audit of the full analytics stack
Procurement needing published ISO 27001, SOC 2, independent audits, or a downloadable DPA out of the box
Very high-traffic properties needing contractual capacity/SLA commitments beyond fair-usage conversation
Policies that ban Cloudflare/Sentry/US payment or optional US AI APIs on any data path
Teams that need session replay, heatmaps, or deep advertising attribution (Clarity/GA territory)

Consider instead when

When: You need open-source and optional self-hosting of the analytics stack
Consider: Plausible Analytics
Estonian product with Cloud plus Community Edition self-host; less bundling of uptime/content monitors.
When: You want European cookieless analytics with a simpler analytics-only scope
Consider: Simple Analytics
Strong privacy positioning; compare feature depth and monitoring separately.
When: You need free-at-scale marketing analytics, ads integrations, or attribution depth
Consider: Google Analytics (incumbent) — or stay on a privacy tool if GA is disallowed
Different privacy and sovereignty profile entirely.
When: You need session replay or heatmaps and accept that privacy model
Consider: Microsoft Clarity or specialised replay tools
Tinylytics deliberately avoids fingerprinting-style session products.

Open questions for due diligence

Swetrix

Can Enterprise contracts exclude or replace Sentry (and other US-group subprocessors) for End User data paths?
Are ISO 27001, SOC 2, or pen-test summaries available under NDA?
What is the exact backup/DR location topology beyond “secure backups” wording on the DPA?
Which Cloud-only features remain permanently out of CE versus delayed open-source release?
For session replay at your traffic volumes, what retention defaults and export/delete SLAs apply on your plan?

Tinylytics

Will Vincent Ritter Consulting sign a GDPR Article 28 DPA and provide a current subprocessor list under contract?
Are backups/DR and email delivery fully covered by the named providers, or are there additional hosts?
Is there any roadmap for independent security review, SOC 2, or ISO 27001?
What contractual terms apply for accounts consistently above the fair-usage hit threshold?
For AI Insights: exact retention, regions, and processor terms at xAI and Google for the paid API plans used?