← Back to Directory
Logo: Pirsch Analytics

Pirsch Analytics

Cookie-free web analytics from Emvi Software GmbH in Germany: hash-based visitor IDs, open-source core, Hetzner-hosted SaaS with funnels, events, and agency white-label.

Open source
analyticsweb-analyticscookie-freeprivacygdpropen-sourcesaasgermanyserver-side-tracking
Visit WebsiteAsk an EU migration specialistFeedback & corrections

Pirsch Analytics is a privacy-oriented web analytics product from Emvi Software GmbH in Rheda-Wiedenbrück, Germany. It is sold mainly as a managed SaaS alternative to Google Analytics: add a lightweight script, CMS plugin, or server-side SDK, then read traffic and conversion metrics without cookies for visitor recognition.

It exists for German and EU site owners who want cookieless marketing analytics with an inspectable tracking core. Visitor distinction uses a one-way hash of IP, User-Agent, date, and a site-specific salt. The vendor states the IP is not stored and recognition lasts at most 24 hours.

The concrete differentiator is that hash design plus an AGPL-3.0 open-source tracking core, with funnels, events, and agency white-label on the commercial dashboard. The full multi-tenant cloud product is not the same as cloning the whole SaaS for free.

Cookie-free hashingOpen-source core (AGPL)Hetzner DE hosting (claimed)Server-side trackingAgency white-labelPublic DPA/AVV

Shortlist Pirsch when you want German-operated, cookie-free web analytics with funnels/events, agency white-label, and a public DPA—hosted on Hetzner per vendor docs. Skip when you need free full-product self-host, session replay/heatmaps, or a stack with zero US-group subprocessors; consider Plausible or Simple Analytics instead.

Key capabilities

Recognizes visitors without cookies by hashing IP, User-Agent, date, and a per-site salt into a short ID. The vendor states IPs are not stored and cross-site linkage is blocked by the salt; sessions expire after 24 hours so long-term profiles are not built. Best for sites that want aggregate traffic metrics without a dedicated analytics cookie banner—confirm ePrivacy/TTDSG fit with counsel.

Instrument via JS snippet, CMS plugins (e.g. WordPress, Shopify, Webflow, Framer), or backend SDKs/API (Go library and other stacks). Server-side collection improves resilience when ad blockers strip client scripts. Tradeoff: backend integration costs more engineering time than a single script tag.

Goes past pageviews with custom events, conversion goals, multi-step funnels, session path exploration, outbound/download/404 tracking, and tags for A/B tests or channel segmentation. Webhooks and email reports push insights into existing tools. Some advanced metrics (e.g. custom event metrics, e-commerce revenue tracking) sit on higher commercial tiers—verify the live feature matrix.

Custom domains, themes, logos, and broader white-label options let agencies present analytics under their own brand. Public dashboards and unique access links support clients without full account sprawl; roles/teams scale collaboration. Strong fit for multi-client portfolios; less relevant for a single personal blog.

Import historical data from Google Analytics, Plausible, or Fathom; export CSV; use the REST API and SDKs for custom pipelines. Pricing docs state unlimited data retention across Standard, Plus, and Enterprise. Limits are usage-based on monthly page views (events and a share of session extensions count)—plan for growth, not perpetual free volume.

At a glance

HQ
Rheda-Wiedenbrück, Germany
Legal entity
Emvi Software GmbH
Category
Web analytics (SaaS)
Open source
Core library AGPL-3.0; full SaaS commercial
Self-host
Enterprise on-prem option; not free CE
Commercial model
Usage-based (monthly page views); trial available
Primary hosting (claimed)
Hetzner Germany (Nuremberg/Falkenstein)

Best fit when

  • EU sites replacing Google Analytics that need pageviews, campaigns, events, and funnels without analytics cookies
  • Agencies needing multi-site dashboards, client access links, and white-label branding
  • Teams that can instrument server-side or proxy scripts for better ad-blocker resilience
  • Buyers who want a German GmbH, downloadable DPA, and Hetzner-Germany residency claims for analytics data
  • Orgs evaluating Enterprise SAML, raw data access, or on-prem/managed private deployment

Poor fit when

  • Teams that require a free, full-product self-hosted community edition (core library ≠ full SaaS)
  • Product or UX research needing session replay, heatmaps, or persistent cross-site user identity
  • Procurement policies that forbid any US-group subprocessor (email CAPTCHA/billing still touch AWS/Google/Stripe/Intuition Machines)
  • Heavy product-analytics / multi-product identity graphs (closer to Amplitude/Mixpanel class tools)

Consider instead when

  • When: You need a free full-stack self-hosted analytics product with AGPL community edition

    Consider: Plausible Analytics (CE) or other open full products in your shortlist

    Pirsch open-sources the tracking core; on-prem of the full product is Enterprise-scoped.

  • When: You want the simplest possible privacy-first metrics with a Dutch vendor

    Consider: Simple Analytics

    Fewer advanced funnel/white-label features; different packaging tradeoffs.

  • When: You need heatmaps or session replay more than classical web analytics

    Consider: Hotjar, Microsoft Clarity, or EU UX-analytics peers

    Expect heavier consent and data-minimization review.

  • When: You must stay inside Google’s advertising and BigQuery measurement ecosystem

    Consider: Google Analytics / Google Tag Manager stack

    Opposite privacy and transfer posture—only if legal review accepts it.

Jurisdiction & ownership

Legal entity
Emvi Software GmbH (Nickelstraße 1b, 33378 Rheda-Wiedenbrück; HRB 11575, AG Gütersloh)
Governing law
Germany / EU GDPR
US parent / control
No known US parent
CLOUD Act exposure (indicative)
Medium
Hosting / residency
Analytics: Hetzner Online GmbH, Germany (vendor claims Nuremberg/Falkenstein). Account/ops subprocessors named in privacy policy include AWS SES (Amazon Web Services EMEA), Google Workspace (Google Cloud EMEA), Stripe, Inc. (US), Intuition Machines, Inc. (US CAPTCHA), and Datev eG (DE).

No known US parent on imprint. Indicative CLOUD Act exposure is medium because of US-group email, CAPTCHA, and payment processors—even though analytics hosting is claimed on German Hetzner. Not legal advice.

  • Independent security / privacy auditNot found
  • ISO 27001Not found
  • SOC 2 / SOC 3Not found
  • GDPR / EU data protectionVendor claimed
  • +3

Considerations & known limitations

  • MediumUS-group account/ops subprocessors

    Even with German analytics hosting claims, customer email, CAPTCHA, and payments involve AWS, Google, Stripe, and Intuition Machines. Sovereign or “no US cloud” policies need explicit exception handling or Enterprise architecture review.

  • MediumNo public ISO/SOC or third-party audit

    Procurement teams that require ISO 27001 or SOC 2 evidence will need vendor questionnaires or NDA materials; public pages did not show those certs.

  • LowOpen-source core ≠ free full self-host

    Teams assuming AGPL means free on-prem of the entire product may be surprised; full on-prem is positioned as Enterprise.

  • LowFingerprinting still needs legal fit review

    Cookie-free hashing is not automatically lawful everywhere without information/consent analysis. Banner removal should be validated for your jurisdiction and tag stack.

  • LowPage-view usage limits

    Plans are metered on monthly page views (with events and partial session extensions counting). Hitting the cap can restrict dashboard access until upgrade or cycle reset—model traffic before cutover.

Open questions for due diligence

  • Can Enterprise on-prem exclude AWS SES / Google Workspace / Stripe / CAPTCHA US-group dependencies for the customer’s deployment?
  • Is any ISO 27001, SOC 2, or independent penetration-test summary available under NDA?
  • Exact data centers, backup locations, and encryption-key custody for multi-tenant SaaS—beyond marketing Hetzner claims?
  • Which feature flags on Standard vs Plus vs Enterprise apply to funnels, A/B tags, e-commerce metrics, and white-label depth at contract time?
Request vendor DPA / enterprise contact
Ask an EU migration specialist
Visit WebsiteCompare similar toolsView alternativesFeedback & corrections

Frequently Asked Questions

The tracking core is open source under AGPL-3.0 on GitHub (pirsch-analytics/pirsch), so you can audit how fingerprints are built. The commercial multi-tenant dashboard/SaaS is not the same as a free full-product community edition. On-premise / self-hosted installation is listed as an Enterprise option alongside managed custom cloud—not the default free path. If you need a fully free self-hosted stack today, evaluate peers such as Plausible CE or other open full products first.

Pirsch states that analytics data is hosted on Hetzner servers in Germany (Nuremberg/Falkenstein named on marketing pages). The public privacy policy also lists AWS SES (email), Google Workspace (contact/appointments email), Stripe (payments), and Intuition Machines (CAPTCHA) among processors for account and site operations. Treat residency claims as applying primarily to the analytics dataset; run a full subprocessor review for procurement.

Pirsch does not use cookies for visitor recognition and markets setups without an analytics cookie banner. That is a product design claim, not a universal legal guarantee. Consent and information duties under GDPR, ePrivacy, and national rules (e.g. Germany’s TTDSG) depend on your exact integration, other tags on the site, and regulator guidance. Use their privacy-policy template as a starting point and have counsel review.

Yes—docs link downloadable Data Processing Agreement PDFs in English and German (AVV). Enterprise marketing includes SAML SSO, raw data access, on-premise installation, managed custom cloud, and dedicated support/onboarding. Standard cloud customers still act as controller for end-user analytics data with Emvi as processor under Art. 28—sign the DPA and map subprocessors into your RoPA.

Choose Plausible when you want a lighter open-source product with a strong free self-host (Community Edition) path and are fine with a simpler feature surface. Choose Simple Analytics when you want maximally minimal metrics and a Dutch vendor story. Prefer Pirsch when German entity/Hetzner messaging, deeper funnels/session tools, agency white-label, server-side SDKs, or Enterprise on-prem/SAML matter more than free full-stack self-host.