Web analytics · hosted in the EU
Web analytics that shows its work.
Cookieless analytics for Nordic and EU sites. Every request is reduced to a few coarse facts before anything is written, and you can see exactly what’s left.
Free during the beta. No card required.
Raw IP and user agent exist only in memory for the length of one request.
- tracker script, gzipped
- < 1 KBtracker script, gzipped
- cookies in strict and anonymous mode
- 0cookies in strict and anonymous mode
- longest life of a visitor hash in anonymous mode
- 24 hlongest life of a visitor hash in anonymous mode
- hosting for all data, on European servers
- EUhosting for all data, on European servers
01 / Day-scoped by design
The same reader on three days is three strangers.
A visit is recognised with a hash of today’s random salt, the site, the IP address and the browser. At midnight the salt is deleted, and nobody, including us, can connect yesterday to today.
- Monday00:00 UTCSalt of the daya8 3f 1c … 9edeleted at midnightSame reader, same browser7f3a 91c2 0b44 e1d7
- Tuesday00:00 UTCSalt of the day52 d0 e9 … 07deleted at midnightSame reader, same browserc04b e617 5a2f 88c3
- WednesdaySalt of the dayf1 6b 2a … c4in use, never logged or backed upSame reader, same browser19d8 a4f0 c3e2 6b15
The trade-off, stated plainly. Weekly and monthly unique visitors count a returning reader once per day. Pageviews, visits, sources and conversions are unaffected.
Never in logs or backups. Salts live in a table that is excluded from write-ahead logs, replicas and backups, and they are deleted when they expire.
Tested on every change. A canary test sends a unique IP and browser string, then searches every database and log for them. If it finds either, the build fails.
02 / Compliance modes
One product, three legal readings.
Analytics consent rules are national, not European. Choose the mode per site; the dashboard adapts to what each mode can honestly measure.
Suggested for Denmark
Strict mode
Danish and German rules have no consent exemption for analytics. Strict mode stores no identifier at all, so unique visitors, bounce rate and visit duration are not available. Use consented mode if you run a consent banner and want those numbers.
Product guidance, not legal advice. You can switch mode per site at any time.
| Capability | StrictNo identifier of any kind | AnonymousHash that expires at midnight | ConsentedCookie, only after consent |
|---|---|---|---|
| Visitor identifier | None | Salted daily hash | Random ID after consent |
| Stored on the device | Nothing | Nothing | One first-party cookie |
| Pageviews, sources, pages | |||
| Unique visitors | Per day | Across days, if consented | |
| Bounce rate, visit duration | |||
| Returning visitors | Consenting visitors |
03 / The dashboard
Everything on one page. Nothing you have to configure.
Sources, pages, countries, devices, goals and custom properties, compared with the previous period. Fast on tens of millions of events.
- Googlesearch9,820
- Direct7,410
- ChatGPTAI assistant3,130
- Newsletteremail2,280
- LinkedInsocial1,690
- PerplexityAI assistant940
- Denmark12,890
- Sweden5,210
- Norway3,380
- Finland2,470
- Germany1,810
- Netherlands990
Click to filter
Any row filters the whole dashboard. Filters live in the URL, so a link is a saved report.
Realtime
Visitors in the last five minutes, and how they got there.
AI assistants as a source
Referrals from ChatGPT, Perplexity, Gemini, Copilot, Le Chat and others are grouped, not lost in “other”.
Goals and funnels
Count signups, purchases or any page pattern, with conversion rates per source.
Share and embed
Public or password-protected links, and an embeddable view for client sites.
Every chart is a table
Built to WCAG 2.2 AA. Charts have data tables, everything works by keyboard.
04 / Collection
A script, a server call, or neither in the browser.
Use the script where it’s fine, and server-side or edge collection where you want no client code at all. The same privacy pipeline handles all three.
One line in your <head>. No cookies, no local storage, no fingerprinting. Single-page apps are tracked automatically.
<script defer data-site="ntq4x8m2"
src="https://in.nordtally.com/s.js"></script>
<!-- custom events -->
<script>
nordtally('event', 'Signup', { props: { plan: 'team' } })
</script>05 / Compliance centre
The paperwork your DPO will ask for, generated from your actual settings.
- Privacy policy sectionEnglish and Danish, per site and mode
- Data processing agreementArt. 28 GDPR
- Sub-processor listShort, and kept current
- Record of processingArt. 30 entry, prefilled
- CNIL self-assessmentThe exemption conditions, one by one
- UK objection noticeFor the DUAA analytics exemption
06 / Agencies
Every client in their own workspace, under one login.
- Lyng Bakery3 sitesclient viewer: owner@lyng
- Saltvik Hotels7 sitesbranded shared dashboard
- Vest Municipality2 sitesstrict mode
Clients see only their own workspace, with your logo on shared links and reports.
07 / Questions
Straight answers.
Do I still need a cookie banner?
Nordtally sets no cookies in strict or anonymous mode. Whether your country still requires consent for analytics is a separate question, and the answer differs: France, the Netherlands, Italy and the UK exempt privacy-friendly audience measurement under conditions; Denmark and Germany currently do not. That is why there are three modes, and why we tell you which one fits instead of promising that no banner is ever needed.
How accurate is it without cookies?
Pageviews, visits, sources and pages are counted as they happen. In anonymous mode, unique visitors are counted per day: the identifier can’t survive midnight, so someone who comes back on three days counts three times in a weekly view. Consented mode recognises returning visitors who said yes. The dashboard says which applies. Server-side and edge collection aren’t affected by ad blockers.
Where is the data?
All data is stored and processed on servers in the EU, run by Hetzner. Account emails are sent through Sendaro from the EU. Nordtally itself uses no US cloud; if you route collection through a proxy such as Cloudflare, that provider handles the request too.
Can I take my data with me?
Every report exports to CSV, and the Stats API returns the same aggregates as JSON. Only aggregates leave the system: visitor and visit identifiers are never exported, shown or returned by the API.
What does it cost?
Nothing during the beta. Paid plans come after it, and you choose one yourself. We don’t ask for a card now, so nothing is ever charged automatically.