GoatCounter
Tiny, open-source, no-cookie analytics you can self-host. Counts visits with a rotating salted hash rather than a stored identifier, and documents exactly what it keeps.
verified 2026-07-11 · grade set per the published methodology
How the grade breaks down
How little it collects, and whether collection is purpose-bound.
Whether it respects GPC, consent state, and tracking-prevention signals.
Cookieless vs. persistent IDs, cross-site linkage, fingerprinting risk.
Where data lives and whether it is shared with third parties.
How verifiable and documented its real behavior is.
At a glance
GoatCounter is a small open-source analytics tool that sets no cookies and stores no persistent identifiers; unique-visit counting uses a rotating salted hash rather than an identifier that is retained as a profile. The entire codebase is public, and the documentation states plainly which fields are stored (page, referrer, coarse device data) and which are not. Self-hosting gives full data ownership; the hosted service is a low-cost alternative run by the project. It ships little built-in consent or governance tooling, but in a standard deployment that adds no custom identifiers there is no personal-data collection for such tooling to gate.
Sources & basis for grade
Grades reflect documented behavior, vendor documentation, and ad.rip scans as of the date above. Each assessment is reproducible and vendors may request correction.
- GoatCounter open-source repository
- GoatCounter privacy / GDPR documentation
- GoatCounter docs on data stored per pageview