Why PureMetrix is privacy-friendly

For us, privacy is a rule the product is built around, not a slogan on a pricing page. Here is what that means in practice for websites and businesses in the EU—WordPress, Shopify, Next.js, or a plain HTML snippet.

No PureMetrix ID cookies

Visitors are counted with a daily hash that uses a salt (a random value) that changes every day. No PureMetrix visitor ID is stored in browser cookies or localStorage.

EU hosting and DPA

Processing on Hetzner servers in the EU. DPA available. See the Privacy Policy.

Staff exclusions

Turn off tracking for selected WordPress roles, Shopify staff, or skip the snippet on admin hosts so your own team doesn’t skew the figures.

Same-origin proxy

Optional /px/js and /px/event on your own domain; WordPress, Vercel, nginx and others can forward the data to PureMetrix.

Small script

Under 3 KB.

What we do not claim

We don’t promise that every website can remove every consent banner. Ads and chat tools still need to be checked. And we don’t advertise features that don’t exist just to tick boxes in a tender.

Agencies

The same clear explanation works for every client: cookieless, EU hosting, optional proxy, role exclusions, Shared Links. Point to the legal pages instead of improvising.

Questions from buyers

Expect buyers to ask where data is processed, whether a DPA exists, and how long raw identifiers are kept. Point them to the DPA, the Privacy Policy and this page instead of improvising answers in a chat.

Design choices, not slogans

Privacy-friendly here means concrete defaults:

No visitor cookies to recognise people
Daily salted hashes to count unique visitors
Processing in the EU on Hetzner
Script under 3 KB
Optional same-origin /px proxy
WordPress role exclusions
A DPA is available; Shared Links mean fewer CSV files and no unnecessary extra accounts

It does not mean “ignore the rest of the page.” Ad and chat tools still need their own legal basis.

How to explain it to buyers

Answer questions about device storage, hosting region and subprocessors from the documentation, not from memory. Offer the DPA when Art. 28 GDPR requires one. Keep screenshots of your role exclusions and the plugin connection for security reviews.

Compared with cookie-heavy defaults

Many WordPress sites end up with GA4 plus a cookie banner because “everyone does it.” PureMetrix reverses that default: measure without a visitor ID cookie, process data in the EU on Hetzner, and keep the script under 3 KB so performance checks stay quick. Role exclusions and Shared Links protect privacy in daily work—your team doesn’t skew the figures, and fewer logins get passed around.

Privacy-friendliness depends on the whole page. Remove ad pixels that would bring the banner back, or load them only after consent. The DPA covers PureMetrix as your processor; your other providers need their own agreements.

Documents for a security review

Put these documents together—they convince more buyers than a landing page full of adjectives:

The analytics section of your privacy policy
Signed DPA
Statement of the hosting region
Screenshot of role exclusions
Network recording showing no PureMetrix identity cookie

Speed as a bonus for privacy

Heavy trackers slow down phones and tempt teams to delay loading until after consent, in ways that ruin the data. A cookieless script under 3 KB plus the optional /px proxy eases that conflict: you measure more of your existing audience without building profiles of people.

Publishers and shops both benefit when privacy and page speed (Core Web Vitals) no longer compete for the same resources.

Trust between agencies and clients

More and more clients ask where their data is stored and whether staff visits skew their reports. Answer with EU hosting on Hetzner, daily salted hashes, role exclusions and Shared Links—then show the DPA. That turns “privacy-friendly” into something you actually do, not just a word on your homepage.

If a prospect has rejected GA4 on principle, don’t bring Google Analytics back through a connector “just for ads” without telling them. Being open about it keeps trust in PureMetrix intact.

Keep an up-to-date entry for PureMetrix in your list of providers—hosting region, cookieless note and DPA date—next to your email and hosting providers, so privacy reviews stay pleasantly uneventful.