← Back to Directory
Logo: nilly

nilly

Swiss privacy-first web analytics (Lyo GmbH): cookieless, sub-1kB tracking with realtime dashboards, city-level geo, custom events, unlimited sites, and a REST API as a lightweight Google Analytics alternative.

analyticsprivacycookie-freegdprswisssaasapi
Visit WebsiteAsk an EU migration specialistFeedback & corrections

nilly is a privacy-first web analytics SaaS for site owners who want pageviews, referrers, geography, technology breakdowns, custom events, and real-time traffic without cookies, IP logging, or browser fingerprinting. It is developed by Gianluca Pirrera through Lyo GmbH in Zurich.

It exists as a lightweight Swiss alternative to Google Analytics. Public pages describe an independent, founder-owned setup. Marketing still brands the service as nilly; the live public site and API currently resolve on kandur.one.

The concrete differentiator is that cookieless, sub-1kB tracking with unlimited sites and a REST API. Confirm the current hostname and legal pages before procurement, because the historic nilly.io hostname did not resolve in research.

Cookieless trackingSwiss-hosted (claimed)Swiss entitySub-1 kB scriptREST APISaaS only

Shortlist nilly when you want Swiss-entity, cookieless, ultra-light site analytics with realtime dashboards, city geo, custom events, unlimited sites, and an API—without GA4 consent weight. Skip when you need self-host/open source, enterprise audit packs, or deep marketing-suite analytics; consider Plausible Analytics, Simple Analytics, or etracker instead.

Key capabilities

Vendor documents a client script under 1 kB with no cookies, no IP tracking, and no fingerprinting for site visitors. Suited to teams that want aggregate traffic metrics without analytics cookie banners; still get counsel for your jurisdiction and CMP setup.

Dashboards cover live visitors, overview metrics, top pages, referrers, UTM campaigns, geography from continent to city, and device/browser/OS breakdowns—enough for content and acquisition decisions without a full product-analytics suite.

Define custom events for conversion-style actions, export statistics as CSV, and receive email reports. Fits operators who need lightweight conversion signals and offline analysis rather than session replay or multi-step funnels.

Documented API endpoints (Bearer API key) manage stats queries (pageviews, visitors, referrers, events, geo, devices, and more), websites, and account objects—useful for internal dashboards or automations on traffic-based plans that include API access.

Public pricing model is pageview-tier SaaS with unlimited websites per account and a short free trial—not a permanent free tier. Good for agencies or multi-brand operators who outgrow per-site free plans elsewhere; confirm current tiers on the vendor site.

At a glance

HQ
Zürich, Switzerland (Lyo GmbH)
Legal entity
Lyo GmbH (CHE-417.675.763)
Product model
SaaS web analytics (not self-hosted)
Tracking
Cookieless; no IP/fingerprint claims
Hosting (claimed)
Switzerland (multi-site)
Commercial model
Traffic-based plans; trial; no permanent free tier
Live site note
kandur.one (nilly branding; nilly.io DNS failed at research)

Best fit when

  • Privacy-conscious SMBs and indie sites replacing GA4 with aggregate metrics only
  • Teams that want Swiss legal entity and Swiss-located analytics servers
  • Operators running many sites who benefit from unlimited websites on traffic tiers
  • Builders who need a simple REST API for pageviews, referrers, geo, and events
  • Sites prioritizing minimal JS weight and fewer analytics consent prompts

Poor fit when

  • Organizations that must self-host or review open-source analytics code
  • Buyers needing published ISO 27001/SOC 2 or a full public DPA/subprocessor pack
  • Marketing teams requiring session replay, heatmaps, or advanced e-commerce/ad sync suites
  • Enterprises that need SSO/SCIM, formal SLAs, and large-vendor assurance paperwork as table stakes

Consider instead when

  • When: You want open-source and/or self-host privacy analytics with a larger community

    Consider: Plausible Analytics or Pirsch Analytics

    nilly is proprietary SaaS only.

  • When: You want another European cookieless SaaS with a simple product story

    Consider: Simple Analytics

    Dutch peer; compare geo depth, API, and residency claims side by side.

  • When: You need deeper marketing, shop, and tag/consent analytics for EU enterprises

    Consider: etracker

    German suite-oriented alternative; heavier than nilly's lightweight dashboard.

  • When: You depend on free unlimited scale and Google ads/ecosystem integration

    Consider: Google Analytics (GA4)

    Different privacy and residency tradeoffs; not a sovereignty shortlist.

Jurisdiction & ownership

Legal entity
Lyo GmbH, Europaallee 41, 8004 Zürich (CHE-417.675.763)
Governing law
Switzerland (terms)
US parent / control
No known US parent
CLOUD Act exposure (indicative)
Medium
Hosting / residency
Vendor FAQ: analytics servers in Switzerland (multiple locations). Public site reverse-DNS: KreativMedia/METANET Zürich. Customer-account subprocessors named in privacy policy: Stripe (US payments), Mailerlite (email). Avatars via Gravatar. No full public subprocessor list for backups/monitoring/CDN.

No known US parent. CLOUD Act exposure is medium mainly due to US-group SaaS on the account/billing path (Stripe; Gravatar), not because visitor metrics are marketed as US-hosted. Indicative only — not legal advice.

  • Independent security / no-logs auditNot found
  • ISO 27001Not found
  • SOC 2 / SOC 3Not found
  • GDPR / EU data protectionVendor claimed
  • +4

Considerations & known limitations

  • MediumBrand/domain transition (nilly.io vs kandur.one)

    Product still branded nilly, but the live marketing/API host is kandur.one; nilly.io did not resolve in DNS during research. Verify tracking domains, docs, and status before production cutover.

  • MediumUS SaaS on customer account path

    Stripe (payments) and Gravatar (avatars) are US-group services. Visitor metrics are claimed Swiss-hosted and non-personal, but account/billing data is not Switzerland-only end-to-end.

  • MediumThin public assurance pack

    No public ISO 27001/SOC 2, independent security audit, or DPA page found. Fine for many SMB shortlists; friction for regulated enterprise questionnaires.

  • LowNo self-host or open-source edition

    Cannot run on your own infra or audit server code from a public repo. Hard limit for sovereignty programs that require self-host.

  • LowSmall independent operator

    Founder-owned Swiss GmbH without VC narrative—positive for independence, but buyers should assess support SLAs, roadmap continuity, and single-vendor concentration.

Open questions for due diligence

  • Will Lyo GmbH sign a B2B DPA and provide a current full subprocessor list (including backups, monitoring, CDN)?
  • Is analytics data retained only on Swiss hosts, or are any DR/replicas outside Switzerland?
  • What is the durable public domain for tracking scripts and API (kandur.one vs nilly.io) for the next 12 months?
  • Are there enterprise features (SSO, roles, retention controls, MSA/SLA) beyond self-serve traffic plans?
  • Can the vendor provide any independent security assessment under NDA?
Request vendor DPA / enterprise contact
Ask an EU migration specialist
Visit WebsiteCompare similar toolsView alternativesFeedback & corrections

Frequently Asked Questions

The vendor states tracking uses no cookies, no IP addresses, and no fingerprinting, and markets compliance with FADP, GDPR, CCPA, PECR/ePR, and PIPL by design, arguing cookie banners are unnecessary for its analytics. That is a product claim, not legal advice: whether your site can omit a banner depends on all tags you load (ads, chat, fonts, etc.) and counsel in your jurisdiction. Treat nilly as reducing analytics-specific consent friction, not as a blanket CMP replacement.

FAQ: analytics servers are located and operated in Switzerland (multiple locations). Privacy policy for customer accounts names Stripe (payments) and Mailerlite (newsletters/service mail); avatars use Gravatar. Marketing host reverse-DNS points at Swiss hosting (KreativMedia/METANET in Zürich). No full public subprocessor matrix (backups, monitoring, CDN) was found—request a current list and DPA before enterprise procurement.

Public materials describe a proprietary SaaS only: no official self-host guide and no open-source license/repo for the core product. If you need on-prem or code audit rights, shortlist Matomo (self-host), Plausible (open source + cloud), or Pirsch instead.

Install via a single script line on arbitrary HTML, with marketing mentions of WordPress, Webflow, Shopify, and Squarespace-style embeds. UTM campaigns work in Acquisitions without special setup. A REST API exposes stats dimensions (pages, referrers, campaigns, geo, devices, events, etc.) plus website and account management for custom pipelines.

nilly is a Swiss, founder-owned, cookieless SaaS with an ultra-light script, city-level geo, custom events, unlimited sites, and API—optimized for simple site analytics. Plausible (Estonia) and Simple Analytics (Netherlands) are closer EU peers with larger public ecosystems; Plausible also offers open source/self-host paths. etracker (Germany) targets deeper marketing/e-commerce analytics and tag/consent tooling. Pick nilly for Swiss residency story + simplicity; pick peers when you need OSS, self-host, or suite depth.