19 ms·

Show HN: Google Analytics alternative with the most generous free tier

124 points by flurly 3y ago

Hi HN, As an indie hacker, the new Google Analytics (GA4) coming motivated me to look for a straightforward alternative that would also be affordable. I had a few basic product requirements and didn’t want to spend too much to replace a free product. There are a lot of great Google Analytics alternatives out there, but the pricing didn’t seem right. As someone who likes to just build things, many of which aren’t businesses yet, it didn’t make sense to pay for options like Plausible and Fathom out of the gate. So I joined with a friend to build Beam Analytics. Beam gives you all the standard web analytics. It also comes with easy to create funnels so you can see how users move through your site. And we have a great proxy for cohort retention that doesn’t need you to log any data with us. It’s cookie-less and GDPR compliant. The free tier is 100k page views per month so hopefully you’ll give it a try. There’s also a Wordpress integration to make integrating with WordPress sites as easy as a single click - https://wordpress.org/plugins/beam-analytics/ https://wordpress.org/plugins/beam-analytics/. Appreciate your feedback. You can also email us at hi (at) beamanalytics.io or DM me on twitter @TheBuilderJR.

deleted 3y ago
[deleted]
openplatypus 3y ago
How do you justify GDPR compliance? GDPR compliance is not to be confused with privacy. You don't have Data Protection Officer (even if you have one, you ought to publish their details). Neither does Plausible. Your privacy policy lacks details, e.g.: where you process data and what is data retention. You are incorporated in not an Adequate Country, meaning you face challenges becoming GDPR-compliant without additional measures that span beyond SCCs. Similarly to Fathom (BC is not under PIPEDA, hence is not adequate). Privacy-friendly? Probably. GDPR-compliant? No.
- shll 3y ago
  Hi - this is the other co-founder of Beam. Thank you for your comments and questions. 1. We are incorporated in the UK. I could be wrong but I think the European Commission did indicate that the UK was an Adequate Country? https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en https://commission.europa.eu/law/law-topic/data-protection/i... 2. For the details that our privacy policy lacks, I think they can be found in our Data Policy. Any further issues, please let us know. https://beamanalytics.io/data https://beamanalytics.io/data 3. On the Data Protection Officer, I think one is only needed if sensitive data on a large scale is processed. https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/data-protection-officers/does-my-companyorganisation-need-have-data-protection-officer-dpo_en https://commission.europa.eu/law/law-topic/data-protection/r... The definition of sensitive data can be found on this EU site and Beam does not process any of this type of data. https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/sensitive-data/what-personal-data-considered-sensitive_en https://commission.europa.eu/law/law-topic/data-protection/r...
  - openplatypus 3y ago
    1. My apologies. I as looking at the link from WordPress. Right. As UK entity you are good. 2. Your subprocessor uses AWS. No way to stay compliant if you transmit visitor IP to US cloud (even if they use European servers). 3. Sadly, wrong. You should immediately consult privacy professional. DPO is necessary. There are 3 tests. https://ico.org.uk/for-organisations/does-my-organisation-need-a-data-protection-officer-dpo/ https://ico.org.uk/for-organisations/does-my-organisation-ne... Answer to question 2 is yes btw. You are not compliant without DPO and because you are using AWS, even if indirectly.
    - neom 3y ago
      Are you saying there is no way to use AWS and be GDPR compliant? Or the way that OP is using AWS isn't GDPR compliant?
      - arlcode 3y ago
        IANAL but as I understand it there is, currently, no way to legally use a service for personal data handling that falls under the US CLOUD act. In theory Amazon could license their brand and software to an independent (!) European company to offer a EU-AWS. Basically if an American judge/agency can order Amazon to hand over European private data and they have the ability to comply without involving a European court the service is not GDPR compliment. Now in practice this isn't how things are done but to the best of my knowledge the law hasn't changed (yet) and national dpas are starting to tighten the screws (slowly). If I recall correctly there are EU-US talks to create Privacy Shield #3.
      - openplatypus 3y ago
        There is a way to use AWS assuming you can assure no Personal Data is processed in plain text on AWS. There was a case of Doctolib in the EU. French authority investigated Doctlib for using AWS. They got off the hook because data was encrypted in the EU, outside of AWS and the encryption keys were inaccessible to AWS. Similarly Sendinblue uses GCP and AWS as dumb storage of externally encrypted backups. There are valid use cases. But these are very limited.
- mattw2121 3y ago
  This is exactly why I ignore the GDPR.
- JackWritesCode 3y ago
  I was linked to this post by a friend regarding the comments you made about Fathom's GDPR compliance. 1. The GDPR is regulation from the European Union 2. PIPEDA has an Exemption order for BC (British Columbia, Canada) and applies "in respect of the collection, use and disclosure of personal information that occurs within the Province of British Columbia". Firstly, the Exemption order states "Whereas the Governor in Council is satisfied that the Personal Information Protection Act, S.B.C. 2003, c. 63, of the Province of British Columbia, which is substantially similar to Part 1 of the Personal Information Protection and Electronic Documents Act, applies to the organizations described in the annexed Order;" Secondly, which part of BC's Personal Information Protection Act would undermine it's adequacy ruling under the GDPR? Finally, let's get into Fathom's pageview/event collection script and explain how it works: 1. There is no collection, use and disclosure of personal information that occurs within the Province of British Columbia 2. EU traffic is automatically routed via EU Isolation and processed on German-owned servers. This allows us to stop US government snooping on EU traffic 3. Fathom Analytics is incorporated in BC. But nobody in BC has access to our EU Isolation infrastructure. I'm the CTO of Fathom Analytics and I have access to our EU Isolation infrastructure. I'm not in BC. Additional access to EU Isolation is from Germany only. Heck, not even GitHub Actions has access to EU Isolation, we self-host GitLab to keep things completely isolated. We put a lot of time and effort into this. I'll wait back to hear back from you on which parts of the BC's PIPA undermine the adequacy ruling. Our lawyer here in Canada is incredibly well versed in Canadian privacy law, so we can definitely loop her in if there's any confusion here. I hope that addresses your point and helps inform other people who may be reading this.
  - openplatypus 3y ago
    https://iapp.org/news/a/schrems-ii-impact-on-data-flows-with-canada/ https://iapp.org/news/a/schrems-ii-impact-on-data-flows-with... > To date, Alberta, British Columbia, and Quebec have privacy legislation that takes commercial activities in those provinces out of the federal jurisdiction through the "substantial similarity" exemption to PIPEDA. Federal privacy law defers to provincial law if a province meets the substantial similarity test, providing a baseline of privacy regulation across Canada. This division of authority is important, because for provinces recognized as substantially similar, their laws have not been given the stamp of "adequacy." I might have framed my statement too strongly. Fathom can be GDPR compliant assuming additional contractual clauses are in place. That is what is mentioned in the linked IAPP assessment. > 3. Fathom Analytics is incorporated in BC. But nobody in BC has access to our EU Isolation infrastructure. I'm the CTO of Fathom Analytics and I have access to our EU Isolation infrastructure. I'm not in BC. Additional access to EU Isolation is from Germany only. Heck, not even GitHub Actions has access to EU Isolation, we self-host GitLab to keep things completely isolated. We put a lot of time and effort into this. The same could be said about Amazon, Google, and Azure employees and their data centre employees in Europe. What matters is effective control. You are not in BC but the company, and your position and responsibilities are governed by the laws of the province of British Columbia. Although, in the case of Canada, SCCs will be actually effective as there are no surveillance laws similar to the US.
Nextgrid 3y ago
> GDPR compliant. The simple fact of sending PII such as IP addresses to a third-party for something that can trivially be done via analyzing existing server logs (without introducing a third-party) already puts this on shaky grounds from a GDPR point of view regardless of everything else.
- zkid18 3y ago
  People sometimes mix the terms and occasionally confuse the terminology, as they often associate GDPR with the concept of "not needing a consent banner." So, yes, you don't need to ask for consent to collect IP addresses to use in analytical purposes or logging. Consent (Article 6 (1)a [0]) is indeed one of the conditions that can be used to comply with the GDPR requirement that processing must be lawful. Still, there are other conditions available to the controller to ensure lawful processing. There are alternatives (before the list of conditions, it says that "at least one of the following" must be satisfied). Logging IP addresses for security is an extremely widespread practice. It is a legitimate interest to comply with standard security practices. The GDPR mandates that the entire data processing cycle maintain a high standard of data protection. This implies that personal data transfers to non-European nations are allowed only if they ensure an adequate level of data protection. Otherwise, contractual agreements (SCCs) between data exporters and importers may translate GDPR's provisions into an enforceable agreement with the foreign importer, ensuring their processing aligns with GDPR. The US had an adequacy decision termed "Privacy Shield," which was revoked due to concerns surrounding the rule of law vis-a-vis US mass surveillance laws. Due to similar reasons, contracts with US-based data importers may also be invalid. Additionally, using EU-based services from US-controlled companies is increasingly becoming worrisome. Beam's approach relies on a weaker variant, which leverages a hash function to derive a pseudo-random ID from user-identifying information, such as the IP address. Although Beam's technique circumvents the need for a large lookup table, an unscrupulous server operator could log the daily key and use it to recover the original data from hashed IDs. The flaw in this approach is that it still hinges on identifying data. While it serves as a good compliance and security measure, it doesn't alter anything significant from GDPR's standpoint. The same applies to competitive solutions like Plausible or Fathom. Disclaimer: Consult with your legal; I am just a product guy. Explored the field to do a similar product a while ago. [0] https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/
bjornsing 3y ago
Can I skip the cookie consent pop up if I use Beam?
mNovak 3y ago
Appreciate the free tier. I seem to recall looking around at analytics options and them being too expensive for my idle projects. Is there more documentation on "custom events" (listed on the pricing page)? I assume this is just an API I can arbitrarily ping. Can that be used for cohort/funnel analysis instead of a /page; e.g. for a single-page app?
- flurly 3y ago
  Yes absolutely! You can use custom events in both funnels and cohort analysis. You can read more about it here https://beamanalytics.io/blog/custom-events-on-beam https://beamanalytics.io/blog/custom-events-on-beam
williamstein 3y ago
I'm interested in Beam Analytics partly because I personally find the new Google Analytics 4 user interface (especially around cohorts) to be surprisingly frustrating to use, and I have used the previous versions of Google Analytics for 10+ years. Is it just me, or did Google Analytics 4 also just get redesigned in a strangely more frustrating way?
- twelve40 3y ago
  it's unusable! I'm sure someone can use it, but the old one needed almost no explanation, and this... I'm definitely shopping around now
- vgeek 3y ago
  I wonder if they acquired Urchin (GA, ~2005, so well before they started cornering mobile/browser markets) to start building out and improving their rankings through the data. If they have user data through Chrome, why would they want to keep footing the bill for hosting free analytics for everyone? What easier way would there be to kick everyone off than launching GA4, which seems to be universally despised? Google's liaisons have said that the data from GA was firewalled, but I'm more skeptical, since a lot of times they say things opposite of what many have actually observed.
  - twelve40 3y ago
    they could have.. I dunno... maybe start charging for it instead of effectively murdering the product?
    - pooper 3y ago
      > they could have.. I dunno... maybe start charging for it instead of effectively murdering the product? Google Analytics has a paid tier but I remember someone on reddit joked like the price is probably too high because they don't even show it publicly...
      - vgeek 3y ago
chubs 3y ago
Oh this looks fantastic, thanks for making it! * Does this mean my site won’t need a cookie alert banner? If no banner, that’s awesome. * what happens if my hobby site gets an unexpected surge in traffic? Will I get an unexpected bill or will analytics disable and I get to choose whether or not to upgrade ? Thanks!
- flurly 3y ago
  > Does this mean my site won’t need a cookie alert banner? Correct > what happens if my hobby site gets an unexpected surge in traffic? Nope. You don't even need to put in CC to sign up. You'll only get billed if you explicitly upgrade. That being said if you are consistently over for many months, we may cut off data ingestion and dashboard access!
5Qn8mNbc2FNCiVV 3y ago
Just added it to my page, was super easy. It doesn't count the same user reloading the page as a single event though. This can be done without PII so yeah, I'd love to see that to be honest
- flurly 3y ago
  Can you elaborate more? Is this in web analytics, funnels or cohort retention? Are you doing basic page views or custom events? Feel free to DM or email hi@beamanalytics.io and we can get this sorted out for you!
  - 5Qn8mNbc2FNCiVV 3y ago
    Just basic page views by throwing the script in and that's it. Nothing fancy
malisper 3y ago
Note that despite the claims of GDPR compliance, Beam is likely _not_ GDPR compliant for a few different reasons. Going off of this doc[0], a few things stand out. First, there's a Javascript snippet you add to your site to set up Beam. That Javascript snippet loads additional Javascript from beamanalytics.b-cdn.net. If you add the Beam provided Javascript to your site, every time a user visits your site, their IP address will be shared with beamanalytics.b-cdn.net. If the user didn't consent to sharing their IP address with beamanalytics.b-cdn.net, you do not have a lawful basis[1] for sharing the user's IP with beamanalytics.b-cdn.net. Second, there's this notion that because Beam hashes IP address that "anonymizes" the data[0][2]. According to GDPR, this is actually "pseudonymisation"[3]. If you know what hash function is used, you can still tie back the hashed data to the original user. Pseudonymized data still meets the GDPR definition of personal data[3] so applying this hash doesn't actually do anything in terms of helping with GDPR compliance. [0]: https://beamanalytics.io/data [1]: https://gdpr-info.eu/art-6-gdpr/ [2]: https://news.ycombinator.com/item?id=35539476#35546091 [3]: https://gdpr-info.eu/art-4-gdpr/
- zadokshi 3y ago
  If pulling a third party resource is not compliant then loading from any cdn is non compliant. Can a website not even load an external font resource?
  - yoavm 3y ago
    Loading fonts from Google Fonts for example is indeed considered not GDPR compliant without consent, because it reveals your visitors IP addresses. You can self hosts the fonts however and then it should be fine.
  - malisper 3y ago
    > If pulling a third party resource is not compliant then loading from any cdn is non compliant Loading data from a third party can be GDPR compliant, but isn't always. One legal basis for processing personal data is "legitimate interest"[0]. Legitimate interest is incredibly vague. In short, it allows you to process data as long as doing so is necessary or of critical important to your business. As an example, in order for someone to visit your website, you need to receive and process their IP address. That's just how TCP works. Since you have a "legitimate interest" to process their IP address so they can visit your site, you don't need to ask for consent before processing their IP. Similarly, since DDOS prevention is critical for maintaining your website, you are allowed to process IP address for DDOS prevention as long as you intend to process the IP only for DDOS prevention. For your specific question, a website loading an external font resource would likely fall under legitimate interest since the font is necessary for the website to function. Since user analytics is not necessary or critical to a business, you cannot share IP address with a third party if the intent of doing so is so you can perform analytics on your users. [0]: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/
noizejoy 3y ago
I have to admit, that I find centralized analytics as a service just really difficult to reconcile with higher degrees of privacy. That’s why I still prefer analytics solutions that can be self hosted.
ovaistariq 3y ago
How would you compare yourself to PostHog?
arco1991 3y ago
Very interesting! Hate the switch to GA4.. Will give this a try!
teaearlgraycold 3y ago
I, too, pay for tailwind UI :P
mukundesh 3y ago
Thanks for the generous free tier. I used plausible for a month then shifted to cloudflare web-analytics, that also has a free tier. Cloudflare UI is very basic, will give beamanalytics a try. Would appreciated if there were any comparisons.
redder23 3y ago
Why use this when we can go straight with true open source projects for that at way more generous and give you basically everything for free without restrictions. Where all they are selling is some official hosting.
skilled 3y ago
I don't think using the word "best" on the landing page is very smart. In fact, you don't even provide a demo page of your own analytics, so how exactly is a anyone supposed to judge whether or not you're the "best", not to mention be comparable to something like Plausible, which has always shown its own analytics as a demo experience. There's definitely a market for this kind of analytics (many similar products have been launched in the last 2 years), but you should probably rethink your strategy a little bit. At the moment, the site feels quite bland (maybe it is a side project, I don't know) and you should perhaps focus more on explaining how you achieve certain things (E.g. How exactly are you compliant?).
fractalf 3y ago
For a simple analytics try https://counter.dev/ https://counter.dev/ which is _open source_ which is a must for proper privacy
- nullcipher 3y ago
  looks interesting. Why is there no release though?
  - ihucos 3y ago
    Hey ho, I am the maintainer of counter.dev. Hmm what you mean with release. It did got two times on the hacker news front page and there is a self hosting golang executable in a seperate but linked github repo as a github release. What you mean with release :-) Le't see if I can do it.
    - ceejayoz 3y ago
      See https://docs.github.com/en/repositories/releasing-projects-on-github/managing-releases-in-a-repository https://docs.github.com/en/repositories/releasing-projects-o....
      - ihucos 3y ago
        Thanks for the clarification. We have: https://github.com/ihucos/counter.dev-selfhost/releases https://github.com/ihucos/counter.dev-selfhost/releases :-) It's on another repo because for self-hosting we "white label" it stripping the logo and so on.
- yreg 3y ago
  Seems similar to Umami (also open source). https://umami.is/ https://umami.is/
- AdriaanvRossum 3y ago
  Simple Analytics is also simple analytics :) https://www.simpleanalytics.com https://www.simpleanalytics.com
pixxel 3y ago
https://beamanalytics.io/blog/proxying-beam-through-cloudflare https://beamanalytics.io/blog/proxying-beam-through-cloudfla... "Proxying Beam Analytics through Cloudflare" "Use proxying to avoid adblockers distorting your data" How does bypassing content/tracking/ad blockers fit into your privacy narrative?
qwerty456127 3y ago
Why do people need things like Google Analytics when they can just self-host? I thought the reason people rather use actual Google Analytics is Google's ability to track specific people across multiple websites and promote websites with Analytics in the search results. But 3-rd party alternatives can't do this anyway or can they?
- weird-eye-issue 3y ago
  > I thought the reason people rather use actual Google Analytics is Google's ability to track specific people across multiple websites and promote websites with Analytics in the search results. This... isn't possible
  - deleted 3y ago
    [deleted]
- layer8 3y ago
  Yes. There are a number of powerful self-hostable open-source website analytics solutions, for example https://github.com/matomo-org/matomo https://github.com/matomo-org/matomo.
  - acatton 3y ago
    matomo and goatcounter are nice, but there are even solutions which don't need any extra CPU or any extra client request: • https://goaccess.io/ https://goaccess.io/ • https://www.awstats.org/ https://www.awstats.org/ Both of them are free/open-source.
    - weird-eye-issue 3y ago
      This is pretty old school, lots of sites these days don't have server logs
  - teekert 3y ago
    Matomo is nice, and a 1 click install in Wordpress as well.
kepler1 3y ago
Why is it that I always have to "talk to you" when I'm at a big company to get a quote, instead of just receiving some standard price I can see on the page? Is it because, working for a big company, there's a sales target on my back and you want to use that to extract the maximum tolerable pricing from my group, just because you can? Is it because my use case is so complicated you think that you need to offer me value-added services that help you achieve the margins you want? Why is it that you, even just as an individual with a startup idea, have already fallen into this kind of pricing behavior? Where did you learn to do this? Do you already have VC-backed sales people telling you to do this? Why is this such a common practice? Maybe that's why I use other services that at least treat me the same as everyone else.
- qwerty456127 3y ago
  Is this only about big companies? I work in a small-to-medium company and people still want to talk to me (even though I write them great detailed and unambiguous emails specifically because I hate calling) every now and then.
graycat 3y ago
I started to watch the Beam video, and here is some immediate and simple constructive criticism: (1) Have the picture of your face BIGGER. Then SMILE and be HAPPY, even a little enthusiastic. (2) Don't drop your voice volume at the end of sentences. Speak VERY clearly: Enunciate the words clearly. E.g., write out the narration and practice reading it. (3) Be sure the room and microphone give good sound quality. Have the sound volume HIGH, TOO high, and let the users reduce the sound volume at their end if they wish. (4) If you know a women who would do you a favor, have her do the narration. Write out carefully a clear narration you want her to say. Better still if she is reasonably pretty, not glamorous but professional and still pretty. (5) There is a lot of numerical data on your screen that is unreadable to 80+% of your target audience. If some text or data is unreadable, then reformat it or just omit it from the presentation. Generally don't put anything on the screen that is unreadable. In simple terms, use a large font 100% black on a white or at least light background. (6) Early in the video there is a graph. There are two curves that are easy to see, but there is annotation on the two axes that is unreadable due to being too small and not dark enough. For such annotation, make it big, black, and easy to read. (7) You may be assuming too much for your best targeted audience, the one with nearly all your candidate customers. E.g., I'm doing a startup, a Web site, have the code running as intended, likely will want some analytics, but so far have had no occasion to find out just what "Google Analytics" is. So, I'm a candidate customer, but to sell to me something or someone will have to give me at least a 101 level introduction to Web site analytics -- it is to your advantage for the part of your audience that needs the 101 introduction for that someone to be you.
ihucos 3y ago
Hello from the competition :-) It looks nice. I like how the main value proposition is actually clearly written out and basically can't not be not read. What I'd like is a live demo where you can quickly see what you get.
kebsup 3y ago
I wouldn't use it just because plausible's design is so shamelessly copied.
Shindi 3y ago
Wow this is simply not true, Microsoft Clarity is free forever and has better analytics. I recommend it to any founder or builder because it comes with free unlimited heatmap. https://clarity.microsoft.com/pricing https://clarity.microsoft.com/pricing
- ihucos 3y ago
  Hmm but is leaving your data with Microsoft much better than with Google? I'd say no.
  - dantyti 3y ago
    As a former user of both (for work), I agree and would never use either for my own projects when I can easily set up a self-hosted cookieless matomo instance. Otoh, my former compliance officer much preferred using MS's product since it explicitly states that it's GDPR and CCPA compliant, while regulator and court decisions against google analytics were piling up in one of the markets we served (EU).
    - ihucos 3y ago
      There is also the ePrivacy Directive. From what at the moment seems to me (it changes), it is in principle possible to make a GDPR compliant web analytics SaaS. But it might not be possible to avoid compliance banners given the current ePrivacy Directive. But most people don't know that thing exists.
- dantyti 3y ago
  I have used google analytics, clarity, and fathom for work, and self-hosted matomo for personal projects. Clarity was the worst in terms of traffic analytics. It's more of a poor hotjar alternative than anything.
  - XCSme 3y ago
    Have you tried UXWizz? Self-hosted, but also comes with heatmaps and recordings compared to Motomo.
prithsr 3y ago
I've been using Beam for a week now - big fan. Analytics are simple enough for my personal projects, and I'm able to add custom event tracking as well which is really nice.
wyem 3y ago
I've been using Beam Analytics for quite some time and just love it for its neat UI as well as for a generous free tier.
worldprogrammer 3y ago
What is the problem with Google Analytics? Did it start charging?
cascada 3y ago
This applies to Plausable as well as to BeamAnalytics: You claim that the data of your users "belongs to them" and only to them. Question: "How can any of your users verify that you're not selling their data?" There's no way other than believing your word. And you have access to the DB. Therefore, given that your claims and the ones of Plausable, can't actually be verified by their users, any time, how is your service different from Google Analytics than? At least with Google Analytics one knows that there's no privacy. In your case the user doesn't know it with certanty because he can't verify it, but he assumes that everything is performed correctly and privacy-friendly -- by taking your, and the owners of Plausible, word for it. It's based mostly on believe, that is.

124 points by flurly 3y ago

deleted 3y ago

[deleted]

openplatypus 3y ago

How do you justify GDPR compliance? GDPR compliance is not to be confused with privacy. You don't have Data Protection Officer (even if you have one, you ought to publish their details). Neither does Plausible. Your privacy policy lacks details, e.g.: where you process data and what is data retention. You are incorporated in not an Adequate Country, meaning you face challenges becoming GDPR-compliant without additional measures that span beyond SCCs. Similarly to Fathom (BC is not under PIPEDA, hence is not adequate). Privacy-friendly? Probably. GDPR-compliant? No.

shll 3y ago
Hi - this is the other co-founder of Beam. Thank you for your comments and questions. 1. We are incorporated in the UK. I could be wrong but I think the European Commission did indicate that the UK was an Adequate Country? https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en https://commission.europa.eu/law/law-topic/data-protection/i... 2. For the details that our privacy policy lacks, I think they can be found in our Data Policy. Any further issues, please let us know. https://beamanalytics.io/data https://beamanalytics.io/data 3. On the Data Protection Officer, I think one is only needed if sensitive data on a large scale is processed. https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/data-protection-officers/does-my-companyorganisation-need-have-data-protection-officer-dpo_en https://commission.europa.eu/law/law-topic/data-protection/r... The definition of sensitive data can be found on this EU site and Beam does not process any of this type of data. https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/sensitive-data/what-personal-data-considered-sensitive_en https://commission.europa.eu/law/law-topic/data-protection/r...
- openplatypus 3y ago
  1. My apologies. I as looking at the link from WordPress. Right. As UK entity you are good. 2. Your subprocessor uses AWS. No way to stay compliant if you transmit visitor IP to US cloud (even if they use European servers). 3. Sadly, wrong. You should immediately consult privacy professional. DPO is necessary. There are 3 tests. https://ico.org.uk/for-organisations/does-my-organisation-need-a-data-protection-officer-dpo/ https://ico.org.uk/for-organisations/does-my-organisation-ne... Answer to question 2 is yes btw. You are not compliant without DPO and because you are using AWS, even if indirectly.
  - neom 3y ago
    Are you saying there is no way to use AWS and be GDPR compliant? Or the way that OP is using AWS isn't GDPR compliant?
    - arlcode 3y ago
      IANAL but as I understand it there is, currently, no way to legally use a service for personal data handling that falls under the US CLOUD act. In theory Amazon could license their brand and software to an independent (!) European company to offer a EU-AWS. Basically if an American judge/agency can order Amazon to hand over European private data and they have the ability to comply without involving a European court the service is not GDPR compliment. Now in practice this isn't how things are done but to the best of my knowledge the law hasn't changed (yet) and national dpas are starting to tighten the screws (slowly). If I recall correctly there are EU-US talks to create Privacy Shield #3.
    - openplatypus 3y ago
      There is a way to use AWS assuming you can assure no Personal Data is processed in plain text on AWS. There was a case of Doctolib in the EU. French authority investigated Doctlib for using AWS. They got off the hook because data was encrypted in the EU, outside of AWS and the encryption keys were inaccessible to AWS. Similarly Sendinblue uses GCP and AWS as dumb storage of externally encrypted backups. There are valid use cases. But these are very limited.
mattw2121 3y ago
This is exactly why I ignore the GDPR.
JackWritesCode 3y ago
I was linked to this post by a friend regarding the comments you made about Fathom's GDPR compliance. 1. The GDPR is regulation from the European Union 2. PIPEDA has an Exemption order for BC (British Columbia, Canada) and applies "in respect of the collection, use and disclosure of personal information that occurs within the Province of British Columbia". Firstly, the Exemption order states "Whereas the Governor in Council is satisfied that the Personal Information Protection Act, S.B.C. 2003, c. 63, of the Province of British Columbia, which is substantially similar to Part 1 of the Personal Information Protection and Electronic Documents Act, applies to the organizations described in the annexed Order;" Secondly, which part of BC's Personal Information Protection Act would undermine it's adequacy ruling under the GDPR? Finally, let's get into Fathom's pageview/event collection script and explain how it works: 1. There is no collection, use and disclosure of personal information that occurs within the Province of British Columbia 2. EU traffic is automatically routed via EU Isolation and processed on German-owned servers. This allows us to stop US government snooping on EU traffic 3. Fathom Analytics is incorporated in BC. But nobody in BC has access to our EU Isolation infrastructure. I'm the CTO of Fathom Analytics and I have access to our EU Isolation infrastructure. I'm not in BC. Additional access to EU Isolation is from Germany only. Heck, not even GitHub Actions has access to EU Isolation, we self-host GitLab to keep things completely isolated. We put a lot of time and effort into this. I'll wait back to hear back from you on which parts of the BC's PIPA undermine the adequacy ruling. Our lawyer here in Canada is incredibly well versed in Canadian privacy law, so we can definitely loop her in if there's any confusion here. I hope that addresses your point and helps inform other people who may be reading this.
- openplatypus 3y ago
  https://iapp.org/news/a/schrems-ii-impact-on-data-flows-with-canada/ https://iapp.org/news/a/schrems-ii-impact-on-data-flows-with... > To date, Alberta, British Columbia, and Quebec have privacy legislation that takes commercial activities in those provinces out of the federal jurisdiction through the "substantial similarity" exemption to PIPEDA. Federal privacy law defers to provincial law if a province meets the substantial similarity test, providing a baseline of privacy regulation across Canada. This division of authority is important, because for provinces recognized as substantially similar, their laws have not been given the stamp of "adequacy." I might have framed my statement too strongly. Fathom can be GDPR compliant assuming additional contractual clauses are in place. That is what is mentioned in the linked IAPP assessment. > 3. Fathom Analytics is incorporated in BC. But nobody in BC has access to our EU Isolation infrastructure. I'm the CTO of Fathom Analytics and I have access to our EU Isolation infrastructure. I'm not in BC. Additional access to EU Isolation is from Germany only. Heck, not even GitHub Actions has access to EU Isolation, we self-host GitLab to keep things completely isolated. We put a lot of time and effort into this. The same could be said about Amazon, Google, and Azure employees and their data centre employees in Europe. What matters is effective control. You are not in BC but the company, and your position and responsibilities are governed by the laws of the province of British Columbia. Although, in the case of Canada, SCCs will be actually effective as there are no surveillance laws similar to the US.

Nextgrid 3y ago

> GDPR compliant. The simple fact of sending PII such as IP addresses to a third-party for something that can trivially be done via analyzing existing server logs (without introducing a third-party) already puts this on shaky grounds from a GDPR point of view regardless of everything else.

zkid18 3y ago
People sometimes mix the terms and occasionally confuse the terminology, as they often associate GDPR with the concept of "not needing a consent banner." So, yes, you don't need to ask for consent to collect IP addresses to use in analytical purposes or logging. Consent (Article 6 (1)a [0]) is indeed one of the conditions that can be used to comply with the GDPR requirement that processing must be lawful. Still, there are other conditions available to the controller to ensure lawful processing. There are alternatives (before the list of conditions, it says that "at least one of the following" must be satisfied). Logging IP addresses for security is an extremely widespread practice. It is a legitimate interest to comply with standard security practices. The GDPR mandates that the entire data processing cycle maintain a high standard of data protection. This implies that personal data transfers to non-European nations are allowed only if they ensure an adequate level of data protection. Otherwise, contractual agreements (SCCs) between data exporters and importers may translate GDPR's provisions into an enforceable agreement with the foreign importer, ensuring their processing aligns with GDPR. The US had an adequacy decision termed "Privacy Shield," which was revoked due to concerns surrounding the rule of law vis-a-vis US mass surveillance laws. Due to similar reasons, contracts with US-based data importers may also be invalid. Additionally, using EU-based services from US-controlled companies is increasingly becoming worrisome. Beam's approach relies on a weaker variant, which leverages a hash function to derive a pseudo-random ID from user-identifying information, such as the IP address. Although Beam's technique circumvents the need for a large lookup table, an unscrupulous server operator could log the daily key and use it to recover the original data from hashed IDs. The flaw in this approach is that it still hinges on identifying data. While it serves as a good compliance and security measure, it doesn't alter anything significant from GDPR's standpoint. The same applies to competitive solutions like Plausible or Fathom. Disclaimer: Consult with your legal; I am just a product guy. Explored the field to do a similar product a while ago. [0] https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/

bjornsing 3y ago

Can I skip the cookie consent pop up if I use Beam?

mNovak 3y ago

Appreciate the free tier. I seem to recall looking around at analytics options and them being too expensive for my idle projects. Is there more documentation on "custom events" (listed on the pricing page)? I assume this is just an API I can arbitrarily ping. Can that be used for cohort/funnel analysis instead of a /page; e.g. for a single-page app?

flurly 3y ago
Yes absolutely! You can use custom events in both funnels and cohort analysis. You can read more about it here https://beamanalytics.io/blog/custom-events-on-beam https://beamanalytics.io/blog/custom-events-on-beam

williamstein 3y ago

I'm interested in Beam Analytics partly because I personally find the new Google Analytics 4 user interface (especially around cohorts) to be surprisingly frustrating to use, and I have used the previous versions of Google Analytics for 10+ years. Is it just me, or did Google Analytics 4 also just get redesigned in a strangely more frustrating way?

twelve40 3y ago
it's unusable! I'm sure someone can use it, but the old one needed almost no explanation, and this... I'm definitely shopping around now
vgeek 3y ago
I wonder if they acquired Urchin (GA, ~2005, so well before they started cornering mobile/browser markets) to start building out and improving their rankings through the data. If they have user data through Chrome, why would they want to keep footing the bill for hosting free analytics for everyone? What easier way would there be to kick everyone off than launching GA4, which seems to be universally despised? Google's liaisons have said that the data from GA was firewalled, but I'm more skeptical, since a lot of times they say things opposite of what many have actually observed.
- twelve40 3y ago
  they could have.. I dunno... maybe start charging for it instead of effectively murdering the product?
  - pooper 3y ago
    > they could have.. I dunno... maybe start charging for it instead of effectively murdering the product? Google Analytics has a paid tier but I remember someone on reddit joked like the price is probably too high because they don't even show it publicly...
    - vgeek 3y ago

chubs 3y ago

Oh this looks fantastic, thanks for making it! * Does this mean my site won’t need a cookie alert banner? If no banner, that’s awesome. * what happens if my hobby site gets an unexpected surge in traffic? Will I get an unexpected bill or will analytics disable and I get to choose whether or not to upgrade ? Thanks!

flurly 3y ago
> Does this mean my site won’t need a cookie alert banner? Correct > what happens if my hobby site gets an unexpected surge in traffic? Nope. You don't even need to put in CC to sign up. You'll only get billed if you explicitly upgrade. That being said if you are consistently over for many months, we may cut off data ingestion and dashboard access!

5Qn8mNbc2FNCiVV 3y ago

Just added it to my page, was super easy. It doesn't count the same user reloading the page as a single event though. This can be done without PII so yeah, I'd love to see that to be honest

flurly 3y ago
Can you elaborate more? Is this in web analytics, funnels or cohort retention? Are you doing basic page views or custom events? Feel free to DM or email hi@beamanalytics.io and we can get this sorted out for you!
- 5Qn8mNbc2FNCiVV 3y ago
  Just basic page views by throwing the script in and that's it. Nothing fancy

malisper 3y ago

Note that despite the claims of GDPR compliance, Beam is likely _not_ GDPR compliant for a few different reasons. Going off of this doc[0], a few things stand out. First, there's a Javascript snippet you add to your site to set up Beam. That Javascript snippet loads additional Javascript from beamanalytics.b-cdn.net. If you add the Beam provided Javascript to your site, every time a user visits your site, their IP address will be shared with beamanalytics.b-cdn.net. If the user didn't consent to sharing their IP address with beamanalytics.b-cdn.net, you do not have a lawful basis[1] for sharing the user's IP with beamanalytics.b-cdn.net. Second, there's this notion that because Beam hashes IP address that "anonymizes" the data[0][2]. According to GDPR, this is actually "pseudonymisation"[3]. If you know what hash function is used, you can still tie back the hashed data to the original user. Pseudonymized data still meets the GDPR definition of personal data[3] so applying this hash doesn't actually do anything in terms of helping with GDPR compliance. [0]: https://beamanalytics.io/data [1]: https://gdpr-info.eu/art-6-gdpr/ [2]: https://news.ycombinator.com/item?id=35539476#35546091 [3]: https://gdpr-info.eu/art-4-gdpr/

zadokshi 3y ago
If pulling a third party resource is not compliant then loading from any cdn is non compliant. Can a website not even load an external font resource?
- yoavm 3y ago
  Loading fonts from Google Fonts for example is indeed considered not GDPR compliant without consent, because it reveals your visitors IP addresses. You can self hosts the fonts however and then it should be fine.
- malisper 3y ago
  > If pulling a third party resource is not compliant then loading from any cdn is non compliant Loading data from a third party can be GDPR compliant, but isn't always. One legal basis for processing personal data is "legitimate interest"[0]. Legitimate interest is incredibly vague. In short, it allows you to process data as long as doing so is necessary or of critical important to your business. As an example, in order for someone to visit your website, you need to receive and process their IP address. That's just how TCP works. Since you have a "legitimate interest" to process their IP address so they can visit your site, you don't need to ask for consent before processing their IP. Similarly, since DDOS prevention is critical for maintaining your website, you are allowed to process IP address for DDOS prevention as long as you intend to process the IP only for DDOS prevention. For your specific question, a website loading an external font resource would likely fall under legitimate interest since the font is necessary for the website to function. Since user analytics is not necessary or critical to a business, you cannot share IP address with a third party if the intent of doing so is so you can perform analytics on your users. [0]: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/

noizejoy 3y ago

I have to admit, that I find centralized analytics as a service just really difficult to reconcile with higher degrees of privacy. That’s why I still prefer analytics solutions that can be self hosted.

ovaistariq 3y ago

How would you compare yourself to PostHog?

arco1991 3y ago

Very interesting! Hate the switch to GA4.. Will give this a try!

teaearlgraycold 3y ago

I, too, pay for tailwind UI :P

mukundesh 3y ago

Thanks for the generous free tier. I used plausible for a month then shifted to cloudflare web-analytics, that also has a free tier. Cloudflare UI is very basic, will give beamanalytics a try. Would appreciated if there were any comparisons.

redder23 3y ago

Why use this when we can go straight with true open source projects for that at way more generous and give you basically everything for free without restrictions. Where all they are selling is some official hosting.

skilled 3y ago

I don't think using the word "best" on the landing page is very smart. In fact, you don't even provide a demo page of your own analytics, so how exactly is a anyone supposed to judge whether or not you're the "best", not to mention be comparable to something like Plausible, which has always shown its own analytics as a demo experience. There's definitely a market for this kind of analytics (many similar products have been launched in the last 2 years), but you should probably rethink your strategy a little bit. At the moment, the site feels quite bland (maybe it is a side project, I don't know) and you should perhaps focus more on explaining how you achieve certain things (E.g. How exactly are you compliant?).

fractalf 3y ago

For a simple analytics try https://counter.dev/ https://counter.dev/ which is _open source_ which is a must for proper privacy

nullcipher 3y ago
looks interesting. Why is there no release though?
- ihucos 3y ago
  Hey ho, I am the maintainer of counter.dev. Hmm what you mean with release. It did got two times on the hacker news front page and there is a self hosting golang executable in a seperate but linked github repo as a github release. What you mean with release :-) Le't see if I can do it.
  - ceejayoz 3y ago
    See https://docs.github.com/en/repositories/releasing-projects-on-github/managing-releases-in-a-repository https://docs.github.com/en/repositories/releasing-projects-o....
    - ihucos 3y ago
      Thanks for the clarification. We have: https://github.com/ihucos/counter.dev-selfhost/releases https://github.com/ihucos/counter.dev-selfhost/releases :-) It's on another repo because for self-hosting we "white label" it stripping the logo and so on.
yreg 3y ago
Seems similar to Umami (also open source). https://umami.is/ https://umami.is/
AdriaanvRossum 3y ago
Simple Analytics is also simple analytics :) https://www.simpleanalytics.com https://www.simpleanalytics.com

pixxel 3y ago

https://beamanalytics.io/blog/proxying-beam-through-cloudflare https://beamanalytics.io/blog/proxying-beam-through-cloudfla... "Proxying Beam Analytics through Cloudflare" "Use proxying to avoid adblockers distorting your data" How does bypassing content/tracking/ad blockers fit into your privacy narrative?

qwerty456127 3y ago

Why do people need things like Google Analytics when they can just self-host? I thought the reason people rather use actual Google Analytics is Google's ability to track specific people across multiple websites and promote websites with Analytics in the search results. But 3-rd party alternatives can't do this anyway or can they?

weird-eye-issue 3y ago
> I thought the reason people rather use actual Google Analytics is Google's ability to track specific people across multiple websites and promote websites with Analytics in the search results. This... isn't possible
- deleted 3y ago
  [deleted]
layer8 3y ago
Yes. There are a number of powerful self-hostable open-source website analytics solutions, for example https://github.com/matomo-org/matomo https://github.com/matomo-org/matomo.
- acatton 3y ago
  matomo and goatcounter are nice, but there are even solutions which don't need any extra CPU or any extra client request: • https://goaccess.io/ https://goaccess.io/ • https://www.awstats.org/ https://www.awstats.org/ Both of them are free/open-source.
  - weird-eye-issue 3y ago
    This is pretty old school, lots of sites these days don't have server logs
- teekert 3y ago
  Matomo is nice, and a 1 click install in Wordpress as well.

kepler1 3y ago

Why is it that I always have to "talk to you" when I'm at a big company to get a quote, instead of just receiving some standard price I can see on the page? Is it because, working for a big company, there's a sales target on my back and you want to use that to extract the maximum tolerable pricing from my group, just because you can? Is it because my use case is so complicated you think that you need to offer me value-added services that help you achieve the margins you want? Why is it that you, even just as an individual with a startup idea, have already fallen into this kind of pricing behavior? Where did you learn to do this? Do you already have VC-backed sales people telling you to do this? Why is this such a common practice? Maybe that's why I use other services that at least treat me the same as everyone else.

qwerty456127 3y ago
Is this only about big companies? I work in a small-to-medium company and people still want to talk to me (even though I write them great detailed and unambiguous emails specifically because I hate calling) every now and then.

graycat 3y ago

I started to watch the Beam video, and here is some immediate and simple constructive criticism: (1) Have the picture of your face BIGGER. Then SMILE and be HAPPY, even a little enthusiastic. (2) Don't drop your voice volume at the end of sentences. Speak VERY clearly: Enunciate the words clearly. E.g., write out the narration and practice reading it. (3) Be sure the room and microphone give good sound quality. Have the sound volume HIGH, TOO high, and let the users reduce the sound volume at their end if they wish. (4) If you know a women who would do you a favor, have her do the narration. Write out carefully a clear narration you want her to say. Better still if she is reasonably pretty, not glamorous but professional and still pretty. (5) There is a lot of numerical data on your screen that is unreadable to 80+% of your target audience. If some text or data is unreadable, then reformat it or just omit it from the presentation. Generally don't put anything on the screen that is unreadable. In simple terms, use a large font 100% black on a white or at least light background. (6) Early in the video there is a graph. There are two curves that are easy to see, but there is annotation on the two axes that is unreadable due to being too small and not dark enough. For such annotation, make it big, black, and easy to read. (7) You may be assuming too much for your best targeted audience, the one with nearly all your candidate customers. E.g., I'm doing a startup, a Web site, have the code running as intended, likely will want some analytics, but so far have had no occasion to find out just what "Google Analytics" is. So, I'm a candidate customer, but to sell to me something or someone will have to give me at least a 101 level introduction to Web site analytics -- it is to your advantage for the part of your audience that needs the 101 introduction for that someone to be you.

ihucos 3y ago

Hello from the competition :-) It looks nice. I like how the main value proposition is actually clearly written out and basically can't not be not read. What I'd like is a live demo where you can quickly see what you get.

kebsup 3y ago

I wouldn't use it just because plausible's design is so shamelessly copied.

Shindi 3y ago

Wow this is simply not true, Microsoft Clarity is free forever and has better analytics. I recommend it to any founder or builder because it comes with free unlimited heatmap. https://clarity.microsoft.com/pricing https://clarity.microsoft.com/pricing

ihucos 3y ago
Hmm but is leaving your data with Microsoft much better than with Google? I'd say no.
- dantyti 3y ago
  As a former user of both (for work), I agree and would never use either for my own projects when I can easily set up a self-hosted cookieless matomo instance. Otoh, my former compliance officer much preferred using MS's product since it explicitly states that it's GDPR and CCPA compliant, while regulator and court decisions against google analytics were piling up in one of the markets we served (EU).
  - ihucos 3y ago
    There is also the ePrivacy Directive. From what at the moment seems to me (it changes), it is in principle possible to make a GDPR compliant web analytics SaaS. But it might not be possible to avoid compliance banners given the current ePrivacy Directive. But most people don't know that thing exists.
dantyti 3y ago
I have used google analytics, clarity, and fathom for work, and self-hosted matomo for personal projects. Clarity was the worst in terms of traffic analytics. It's more of a poor hotjar alternative than anything.
- XCSme 3y ago
  Have you tried UXWizz? Self-hosted, but also comes with heatmaps and recordings compared to Motomo.

prithsr 3y ago

I've been using Beam for a week now - big fan. Analytics are simple enough for my personal projects, and I'm able to add custom event tracking as well which is really nice.

wyem 3y ago

I've been using Beam Analytics for quite some time and just love it for its neat UI as well as for a generous free tier.

worldprogrammer 3y ago

What is the problem with Google Analytics? Did it start charging?

cascada 3y ago

This applies to Plausable as well as to BeamAnalytics: You claim that the data of your users "belongs to them" and only to them. Question: "How can any of your users verify that you're not selling their data?" There's no way other than believing your word. And you have access to the DB. Therefore, given that your claims and the ones of Plausable, can't actually be verified by their users, any time, how is your service different from Google Analytics than? At least with Google Analytics one knows that there's no privacy. In your case the user doesn't know it with certanty because he can't verify it, but he assumes that everything is performed correctly and privacy-friendly -- by taking your, and the owners of Plausible, word for it. It's based mostly on believe, that is.