Counter.dev Review (2026)

Counter.dev is the privacy-first idea taken to its philosophical extreme. Read the source code: backend/endpoints/track.go never calls r.RemoteAddr. The backend literally does not see visitor IPs — Cloudflare extracts the country at the edge via CF-IPCountry header and the backend works from that. There is no salt to rotate because there is no identifier to hash.

The tracker is 1.1 KB. The whole stack is a Go server + Redis (hot tier) + SQLite (cold archive) running on a single ~$5/mo VPS that the developer (ihucos) says serves "millions of unique visits per month at 25% CPU." The frontend is a small set of Web Components, the dashboard polls and shows hourly/daily numbers near-realtime.

Pricing is Pay-What-You-Want — permanent free tier with no quotas, no feature gates, optional donation tiers from €3/mo via PayPal. Self-host is AGPL-3.0 with a Docker recipe at github.com/ihucos/counter.dev-selfhost. License-wise it sits in the same camp as Plausible (AGPL-3.0) but with the indie-craft sensibility of GoatCounter.

Counter.dev is a solo-dev project with no legal entity, no privacy policy, and no published hosting region. /privacy returns 404. /terms returns 404. /about returns 404. There is no DPA. The domain has expired in the past (issue #124, 2025). There are no third-party security certifications.

For procurement, this is disqualifying — there is no vendor to point a security questionnaire at. For accountable analytics, GoatCounter (Martin Tournoij sole-trader, IE, full privacy policy, Hetzner FI+DE) is the same idea done professionally.

Feature breadth is minimal by design. No funnels, no custom events, no goals, no A/B testing, no error tracking, no heatmaps, no email reports. The /track endpoint accepts pageviews and that's it; there is literally no events endpoint in the backend code. If you need product analytics, look at OpenPanel ($2.50 entry, AGPL self-host) or Umami ($0/$20, MIT).

Recent commit cadence (2025-2026) is mostly copy edits and blog posts, not feature work. Bus factor is one. DNT honoring is site-level localStorage flag only — does NOT respect the browser-level navigator.doNotTrack header (which only Fathom does in this directory).

Best for: indie developers, hobbyists, side projects, personal blogs, GitHub-Pages-deployed sites — anyone whose analytics need is "I want a number that says how many people visited yesterday and where they came from" with the strongest possible privacy posture.

Real value at $0: Counter.dev's permanent free tier covers virtually any small-site need. The optional €3+/mo PWYW model is genuinely optional — there are no quotas, no feature gates.

Not for: Anyone running marketing campaigns that need conversion attribution; anyone in a regulated industry (no DPA, no certifications); anyone whose security review requires a published privacy policy from the analytics vendor; anyone whose embedding site is itself subject to enterprise procurement; anyone who needs funnels, goals, or events. For all of those use cases, look at Plausible ($9 entry, full vendor accountability) or Umami ($0/$20, named legal entity).

Single snippet drop-in. Sign up at counter.dev (no credit card), get a data-id token, paste:

`html

`

That's it. Tracker is 1.1 KB, fires once per tab via sessionStorage flag, sends a single fetch POST to t.counter.dev/track with country (via Cloudflare), referrer, screen size, language. No multi-page tracking by default — the optional external tracker (cdn.counter.dev/script.js) handles pageview tracking on subsequent pages.

Self-host: clone github.com/ihucos/counter.dev-selfhost, set Redis + Mailgun-or-SMTP + cookie/password salt env vars, docker-compose up. Same code as Cloud. Stack is Go + Redis + SQLite. AGPL-3.0 means SaaS forks must publish source.

Custom events / funnels / goals: None of these exist. If you need them, Counter.dev is not the right tool.

Migration from GA4 doesn't really apply — Counter.dev tracks pageviews, country, referrers, and basic device breakdowns. There is no event taxonomy to port, no funnels to recreate, no goals to redefine. Just paste the script and you're done.

Banner removal: The vendor itself flags ePrivacy ambiguity ("I don't know" — verbatim from FAQ). Counter.dev does NOT formally self-certify consent-free deployment. If banner removal is a hard requirement, Plausible, GoatCounter, or Wide Angle have clearer legal posture.

From GoatCounter: the pure web-counter migration is trivial — replace the snippet, the rendered metrics are similar (pageviews, top pages, country, referrers). You'll lose GoatCounter's UTM auto-capture, public dashboards, and team accounts. Most operators stay with GoatCounter once they're on it because the published privacy policy and legal entity are worth the $0 price differential.