← Back to Directory
Logo: Swetrix

Swetrix

Cookieless, privacy-first web analytics from a UK company: traffic, funnels, errors, and performance on Hetzner in Germany, with AGPLv3 self-host Community Edition and optional Cloud session replays.

Open sourceSelf-hosted
analyticscookielessopen-sourceprivacygdprself-hostproduct-analytics
Visit WebsiteAsk an EU migration specialistFeedback & corrections

Swetrix is a cookieless, privacy-first web analytics platform from Swetrix Ltd in Edinburgh, United Kingdom. It is aimed at teams that want traffic and product insights without cookies or advertising profiles. The cloud product is marketed as a Google Analytics alternative.

It exists as a UK company with Cloud analytics hosted on Hetzner in Germany, plus an official Docker-based Community Edition. The same core stack is published under AGPLv3 on GitHub.

The concrete differentiator is that combination of cookieless traffic, funnels, errors, and performance, with optional Cloud session replays and a self-host exit.

Cookieless trackingHetzner DE hostingOpen source (AGPLv3)Self-host CEFunnels + errors + RUMPublic DPA

Shortlist Swetrix when you want cookieless traffic plus product-oriented tools (funnels, RUM, errors, optional Cloud replays) under a UK company with Hetzner DE hosting and AGPLv3 self-host CE. Skip when you need public ISO/SOC packs, zero US-group subprocessors, multi-year cookie retention cohorts, or free forever hosted analytics—consider Plausible Analytics or Simple Analytics for minimal traffic-only privacy analytics, or Matomo for heavyweight self-host control.

Key capabilities

Lightweight script captures pageviews, referrers/UTMs, devices, and city-level geo without cookies or client-side storage. Per the Data Policy, IP and User-Agent are hashed in memory with a daily rotating salt; only a random session id is stored—so you get sessions without long-term cross-day visitor retention.

Instrument signups, purchases, and other conversions as custom events; build multi-step funnels and goals in the dashboard. Useful for product and growth teams who need drop-off analysis without bolting on a second product-analytics SaaS.

Records Web Performance API timings (TTFB, DNS, TLS, render, full page load) and optional JavaScript errors with stack/context by page and browser. Bridges marketing traffic views with engineering signals that pure pageview tools omit.

Cloud projects can call startSessionReplay() to record DOM and interactions; default modes mask text/inputs. Replays are not created by ordinary pageviews—customers must enable them and own consent, masking, and page exclusions. Cloud-only versus Community Edition.

Core platform is public on GitHub under GNU AGPLv3; Community Edition deploys via official Docker docs with MySQL, ClickHouse, and Redis. CE includes core analytics, events, sessions, funnels, performance, and errors—but not all Cloud extras (replays, some alerts/org/AI features).

Configure alerts to email, Slack, Telegram, Discord, webhooks, or push; pull or push data via the API; import GA4 history; invite organisations with roles or share password-protected/public dashboards. Fits agencies and multi-site operators who outgrow single-user tools.

At a glance

HQ
Edinburgh, United Kingdom
Legal entity
Swetrix Ltd (SC797389)
Governing law
Scotland (Terms)
Primary hosting
Hetzner Online GmbH, Germany
License
AGPLv3 (Community Edition)
Commercial model
Event-volume Cloud subscription; free self-host CE; timed trial
Open source
Yes — github.com/Swetrix/swetrix

Best fit when

  • SMEs, agencies, and product teams replacing GA4 who need cookieless traffic stats without a cookie banner driven only by analytics
  • Engineering-minded buyers who want error tracking and real-user performance in the same privacy-first dashboard as pageviews
  • Teams that may enable Cloud session replays later but can treat them as explicit opt-in with their own legal basis
  • Operators willing to run Docker Community Edition (MySQL/ClickHouse/Redis) when Cloud commercial terms or feature limits do not fit
  • Buyers who need a public B2B DPA, API access, GA4 import, and multi-channel alerts under a UK legal entity

Poor fit when

  • Enterprises that require published ISO 27001 / SOC 2 certificates or independent audit PDFs before shortlist
  • Policies that forbid any US-group subprocessors (Sentry is listed for End User error data; AWS/OpenRouter appear for customer services)
  • Use cases that depend on long-term cookie-based retention or cross-device identity graphs
  • Buyers who only want free hosted analytics with no paid Cloud tier and no self-host operations burden
  • Sites that will run session replays on sensitive flows without capacity to configure masking, exclusions, and consent

Consider instead when

  • When: You only need minimal cookieless pageviews/referrers with the smallest possible product surface

    Consider: Plausible Analytics or Simple Analytics

    Swetrix adds funnels, errors, RUM, and Cloud replays; peers stay closer to pure traffic analytics.

  • When: You need deep on-prem control, plugins, and mature enterprise self-host packaging

    Consider: Matomo (self-host or managed EU hosts such as Matomo by Stackhero)

    Heavier ops and optional cookies; stronger fit for large controlled deployments.

  • When: You must stay inside Google advertising measurement and free GA4 ecosystem tooling

    Consider: Google Analytics

    Trade privacy, consent, and transfer complexity for ads integration and zero software fee.

Jurisdiction & ownership

Legal entity
Swetrix Ltd (SC797389), Edinburgh, Scotland
US parent / control
No known US parent
CLOUD Act exposure (indicative)
Medium
Hosting / residency
Cloud analytics data: Hetzner Online GmbH (Germany) per DPA/Data Policy. End User error monitoring sub-processor: Sentry / Functional Software Inc. (United States). Customer-side Privacy Policy list also includes Paddle (UK payments), Fastmail (Australia business email), AWS (US transactional/marketing email), OpenRouter (US optional AI chat). No known US parent.

UK entity with EU (Germany) primary analytics hosting and UK adequacy context, but US-group subprocessors (notably Sentry for End User errors, plus AWS/OpenRouter for ancillary customer services) mean indicative CLOUD Act exposure is medium, not low. Session replay and custom fields remain customer controller responsibilities. Not legal advice.

  • Independent security / no-logs auditNot found
  • ISO 27001Not found
  • SOC 2 / SOC 3Not found
  • GDPR / EU data protectionVendor claimed
  • +3

Considerations & known limitations

  • MediumUS-group subprocessors (Sentry, AWS, OpenRouter)

    Primary analytics hosting is Hetzner DE, but Sentry (US) is an End User error-tracking sub-processor on the DPA, and AWS/OpenRouter appear for customer email/AI. Orgs with strict no-US-cloud rules need explicit acceptance or self-host CE to avoid those paths.

  • MediumSession replay is opt-in and controller-owned

    Cloud replays can capture DOM and inputs unless masked. Customers must enable startSessionReplay(), configure privacy modes/exclusions, and provide notices/consent where required—misconfiguration can reintroduce personal data risk that standard cookieless pageviews avoid.

  • MediumNo public ISO/SOC or third-party audit

    Assurance relies on first-party policies, Hetzner infrastructure claims, and open source. Enterprise questionnaires that hard-gate on certs will stall until materials are provided under NDA or produced.

  • LowCloud vs Community Edition feature gap

    Self-host CE is free and covers core analytics, but replays and several Cloud growth/ops features are limited or Cloud-only. Budget and feature planning must not assume feature parity.

  • LowDaily salt rotation limits retention metrics

    Cookieless design deliberately prevents classic multi-day visitor retention. Teams that need that metric class need another product or consented identity.

Open questions for due diligence

  • Can Enterprise contracts exclude or replace Sentry (and other US-group subprocessors) for End User data paths?
  • Are ISO 27001, SOC 2, or pen-test summaries available under NDA?
  • What is the exact backup/DR location topology beyond “secure backups” wording on the DPA?
  • Which Cloud-only features remain permanently out of CE versus delayed open-source release?
  • For session replay at your traffic volumes, what retention defaults and export/delete SLAs apply on your plan?
Request vendor DPA / enterprise contact
Ask an EU migration specialist
Visit WebsiteCompare similar toolsView alternativesFeedback & corrections

Frequently Asked Questions

Per the public Data Policy, each request’s IP and User-Agent are combined with the project id and a daily rotating salt, hashed in memory, then mapped to a random number stored for the session. Raw IP/UA and the hash are not persisted. That design supports same-day session stitching without cookies, but it cannot power multi-day retention or classic cross-device identity the way cookie-based tools do. Optional User Profiles use a monthly salt rotation, and customer-supplied profileIds require the site owner to handle consent.

The DPA and Data Policy state analytics data is stored/processed on Hetzner servers in Germany. The DPA explicitly lists Sentry (US) as a sub-processor for error tracking of End User data. The Privacy Policy also lists Paddle (UK payments), Fastmail (AU business email), AWS (US) for transactional/marketing email to customers, and OpenRouter (US) for optional AI chat. Primary residency is EU; secondary US-group services mean transfer diligence is still required.

Replays are an optional Cloud feature. Recording starts only when your site calls startSessionReplay(); normal pageviews, custom events, and errors do not create replays. Privacy modes (total / normal / none) control masking of text, inputs, and media. Swetrix documents that customers must decide lawfulness, notices, consent or other legal basis, exclusions, and retention—especially before recording forms or sensitive workflows.

There is no free forever Cloud plan; Cloud is event-volume subscription software with a time-limited trial. Community Edition on GitHub is free to run yourself and includes core traffic analytics, custom events, sessions, funnels, performance, and error tracking per the project README. Session replays, some advanced geo/network intelligence, certain alerts/email reports, revenue/experiments/AI features, and full organisation tooling are described as Cloud-oriented or limited on CE—verify the current Cloud vs CE table before committing.

Yes. A public Data Processing Agreement at swetrix.com/dpa is incorporated by reference into the Terms; using the Service constitutes acceptance. Swetrix is processor for visitor data; the customer is controller. The DPA describes cookieless hashing, Hetzner DE hosting, Sentry as error-tracking sub-processor, breach notice, and deletion from the dashboard. Signed copies can be requested via contact if procurement requires wet-ink or countersignature.

At research time, no public ISO 27001 or SOC 2 certificate, registry listing, or independent no-logs/security audit PDF was found on the marketing, DPA, or privacy pages. Assurance is primarily first-party policies, open-source code, and infrastructure claims (Hetzner DE, HTTPS, backups). Procurement teams that hard-require cert packs should ask Swetrix under NDA or treat this as a gap versus larger enterprise analytics vendors.