Lightest stack in the entire category. Single static Go binary (~10-15 MB), SQLite by default, Docker optional. No Postgres, no ClickHouse, no Redis, no Kafka. Comfortable on a $5/mo VPS with 256 MB RAM. Contrast with Plausible (Postgres + ClickHouse) or Matomo (PHP + MySQL + Redis archiving cron).
GDPR posture, sub-processors under DPA, per-jurisdiction stance, and encryption — everything a procurement team checks.
?GDPR✓ CompliantEU General Data Protection Regulation
EU's omnibus privacy law requiring a lawful basis for processing personal data (consent, legitimate interest, etc.). Applies to anyone handling EU-resident data. GoatCounter's posture: Legitimate interest. ?CCPA✕ Not heldCalifornia Consumer Privacy Act
California Consumer Privacy Act — rights for California residents (access, deletion, opt-out of sales). Triggered at $25M revenue or 50k+ CA-consumer records. ?UK PECR✕ Not heldUK Privacy and Electronic Communications Regulations
UK Privacy and Electronic Communications Regulations sit on top of GDPR specifically for cookies and electronic marketing. PECR Reg 6 governs analytics-cookie consent. ?SOC 2 · II✕ Not heldSOC 2 Type II
SOC 2 Type II — independent audit verifying security/availability controls operate effectively over 6+ months. Standard B2B procurement requirement. ?ISO 27001✕ Not heldISO/IEC 27001 information-security
ISO/IEC 27001 — international information-security management standard, certified by accredited bodies on a 3-year renewal cycle. ?HIPAA✕ Not heldUS HIPAA (with BAA)
US health-data law requiring a Business Associate Agreement (BAA) for any tool touching protected health information. Without BAA the tool cannot legally process PHI.
Per-jurisdiction posture
🇫🇷
FranceCNILNo banner
Cookieless + no PII = CNIL-exempt.
?France · CNIL
Cookieless + no PII = CNIL-exempt. 🇬🇧
United KingdomUK ICO / PECRBanner recommended
PECR Reg 6 likely doesn't trigger (no cookies), but no formal ICO ruling.
?United Kingdom · UK ICO / PECR
PECR Reg 6 likely doesn't trigger (no cookies), but no formal ICO ruling. 🇩🇪
GermanyTTDSGBanner recommended
TTDSG §25 stricter reading by some German DPAs — disclosure recommended.
?Germany · TTDSG
TTDSG §25 stricter reading by some German DPAs — disclosure recommended. 🇮🇹
ItalyGaranteBanner recommended
Italian Garante is the strictest in EU — disclosure recommended.
?Italy · Garante
Italian Garante is the strictest in EU — disclosure recommended.
Sub-processors (3)
GDPR Art. 28 disclosure — third parties under DPA that may receive data.
🇮🇪
Martin Tournoij (sole trader)
Legal entity (sole-trader data processor)
Ireland
🇫🇮
Hetzner Online GmbH
Cloud hosting — Finland AND Germany data centers
Finland
Real plans, real numbers — pulled from goatcounter.com (verified May 2026).
Self-hosted
Free/free
Unlimited
✓ Single Go binary
✓ SQLite default
✓ Built-in TLS
✓ Forever free
Cloud (free)
Free/free
Reasonable use
✓ Personal + SMB
✓ No card needed
✓ No formal cap
Donate
Custom
—
✓ GitHub Sponsors
✓ Pay-what-you-can
✓ Supports the maintainer
Tech specs
Stack, repo health, deployment options — for engineers evaluating self-host.
Stack
Written inGo ≥1.21
DatabaseSQLite (default) · PostgreSQL (optional)
TLSBuilt-in Let's Encrypt + ACME
LicenseEUPL-1.2 (server) · ISC (count.js)
Min specs~256 MB RAM · 1 vCPU (community-reported, no vendor floor)
GitHub github.com/arp242/goatcounter
Stars★ 5,662
Forks254
Open issues33
Last commit5 days ago
Deploy
· Single static binary
· Docker
· From source
Used by
Companies and projects that publicly trust GoatCounter.
NLnet NGI0 grant
arp242.net
Editor review
Reviewed by Mark Sutton, cross-checked against vendor documentation. Click any panel to expand.
+What it does well▾
Lightest stack in the entire category. Single static Go binary (~10-15 MB), SQLite by default, Docker optional. No Postgres, no ClickHouse, no Redis, no Kafka. Comfortable on a $5/mo VPS with 256 MB RAM. Contrast with Plausible (Postgres + ClickHouse) or Matomo (PHP + MySQL + Redis archiving cron).
Genuinely free for personal use. Vendor's homepage explicitly says: "GoatCounter.com is currently offered for free for reasonable public usage. Running your personal website or small-to-medium business on it is fine." No card, no nag, no pressure to upgrade. Donation-supported via GitHub Sponsors.
Most aggressive privacy posture in the cookieless category. Salt rotates every 8 hours (vs daily for Plausible/Fathom/Pirsch, monthly for Umami). Cross-visit linkability window is the shortest in the field.
EUPL-1.2 license. A weak-copyleft, EU-jurisdiction-aware license. Friendlier than AGPL for derivative work; the integration script count.js is separately ISC-licensed for frictionless embedding.
NLnet NGI0 grant funded. EU public-interest software grant — not VC-backed, not running on burn rate.
−Weaknesses & gotchas▾
Solo developer — bus factor of 1. GoatCounter is built and maintained by Martin Tournoij (arp242) alone. No co-maintainers visible in the repo. If Martin stops, the hosted service goes with him. The OSS code keeps working forever (it's a static binary), but there's no roadmap velocity, no community of contributors absorbing requests.
UI is intentionally basic / dated. No dark mode polish, no drag-rearrange dashboards, simple bar charts. Reviewers consistently note it looks "2010-era" — fine for a personal blog, jarring next to Umami's modern React dashboard.
Feature gaps are real. No funnels, no goals/conversions, no custom dimensions, no A/B testing, no session replay, no heatmaps, no mobile SDKs, no webhooks, no plugin system. If you outgrow basic pageviews + referrers + UTM, you outgrow the tool.
No GA4 importer. Migration tooling is logfile-based only (nginx/Apache/Caddy/CloudFront). No one-click backfill from Google Analytics.
No official WordPress plugin. Community manual install only — search "goatcounter" on wordpress.org and nothing matches.
No HIPAA / no SOC 2 / no ISO 27001. No formal certifications; appropriate for solo blogs and OSS docs, not enterprise procurement.
★Best for▾
Best for solo bloggers and writers (Hugo, Jekyll, Astro static sites), OSS maintainers tracking docs/landing pages, privacy-first indie hackers on $5 VPS budgets, and side-project owners who want zero ops burden. Anyone tired of GA4's UI complexity who just wants pageviews + referrers.
Self-hosting is the obvious recommendation — a single Go binary on SQLite scales fine for any solo/small portfolio without ever paying anyone. Cloud is for people who don't want to even think about it.
Not for e-commerce sites (no goal/revenue tracking), marketing teams running paid acquisition (no UTM funnel attribution), agencies managing multi-client dashboards with white-label needs, anyone needing session recordings or A/B testing, teams requiring SSO/SAML or RBAC, or healthcare contexts requiring a BAA.
⚡Setup walkthrough▾
Self-host (recommended):
1. Download single static binary from github.com/arp242/goatcounter/releases (Go binary, ~10-15 MB).
2. goatcounter serve -listen :8080 -tls http — that's it. SQLite is default storage, no DB to set up.
3. Built-in Let's Encrypt + ACME for TLS.
4. Add a single to your pages.
5. ~5-10 minutes total.
Cloud (free):
1. Sign up at goatcounter.com — free for personal use, no card.
2. Get your subdomain (yoursite.goatcounter.com).
3. Paste the snippet.
4. ~2 minutes.
Docker also available for containerized deploys (arp242/goatcounter on Docker Hub).
↔Migrating from GA4▾
No GA4 importer. GoatCounter doesn't ship one and the maintainer has stated no plans to build one. Migration is a clean cut, not a data merge.
Logfile import is the only documented migration path: goatcounter help import reads nginx, Apache, Caddy, and CloudFront access logs to backfill historical pageview data into GoatCounter.
Recommended: parallel tracking for ~30 days. Don't expect identical numbers — GoatCounter's 8-hour salt rotation means uniques drift differently from GA4's persistent Client-ID. Export GA4 historical data to BigQuery if you need it preserved before sunset.
The honest pitch: if you're moving away from GA4 because you wanted relief from complexity, GoatCounter is the relief. If you wanted historical-data continuity, look at Plausible/Fathom (free GA4 importers) instead.
Help & FAQ
Where to get help with GoatCounter and the questions buyers email us about.
Support
HoursAsync (single developer)IST (UTC+0/+1)
ChannelsEmail · Github issues
LanguagesEnglish
Response SLA~72h
FAQ (6)
Is GoatCounter actually free?▾
Yes — for personal use, OSS projects, hobby sites, and small/non-profit organizations the Cloud version is permanently free (donation-supported via GitHub Sponsors). Larger commercial use is asked to pay $15/mo for Cloud. Self-hosted is free under EUPL-1.2.
Why is GoatCounter so minimalist?▾
By design. The maintainer Martin Tournoij decided analytics didn't need a Series B — it's a 3KB script and a single Go binary on SQLite. No funnels, no session recording, no e-commerce attribution, no fancy dashboards. If you outgrow it, switch to Plausible/Fathom/Matomo. Until then, GoatCounter stays out of your way.
Does GoatCounter honor Do Not Track?▾
No. The maintainer's published position is that DNT was rendered useless by the ad-tech industry years ago and is not a meaningful privacy signal. GoatCounter argues that since it doesn't collect personal data anyway, DNT is moot. Visitors who want to opt out should use a browser ad-blocker.
Can I self-host GoatCounter on a $5 VPS?▾
Yes — that's the explicit design target. GoatCounter is a single Go binary using SQLite by default (PostgreSQL optional for higher traffic). It runs comfortably on 256MB RAM, 1 CPU. Built-in TLS via Let's Encrypt — no nginx/Caddy needed.
How is GoatCounter different from Plausible?▾
GoatCounter is a one-person project, free for personal/SMB use, intentionally minimalist (no funnels, no goals beyond simple events), and runs as a single Go binary on SQLite. Plausible is venture-funded with a 10+ person team, has Cloud-only features (Looker Studio, sub-folder views), runs on Elixir + ClickHouse, and starts at $9/mo. GoatCounter wins on minimalism + price; Plausible wins on polish + features.
Where is GoatCounter hosted?▾
Hetzner Online GmbH data centers in Finland and Germany — exclusively EU. The legal entity is Martin Tournoij (sole trader), based in Ireland per the privacy policy.
