Tutorial · 25 August 2026
Where Cookie Free Analytics actually stores pageviews
A lot of analytics blogs say “hosted in Europe” and stop. The useful question is which process, in which region, under which company law. Cookie Free Analytics answers it in three facts, not a flag.
Beacons hit Vercel in Frankfurt (fra1). Pageviews sit in Postgres in Ireland (eu-west-1). The operator is Prestons Creek Capital, KvK 42139404, VAT NL005528479B09. Vercel is still a US company. A European data-centre address does not make the vendor EU-owned.
What this product stores
The script sends site id, hostname, path (five UTM tags only), referrer origin + path, and an optional event name. The server adds browser, OS, device, and edge country / region / city labels. Same-day uniques are HMAC of site + IP + user-agent with a pepper and a salt we delete at UTC midnight. Sixteen bytes go on the row. The IP does not.
That HMAC is still personal data. We say so on /methodology and in the DPA. It is not a cookie, and it is not a profile you can join across days.
CLOUD Act in one paragraph
US law can reach a US provider even when the disk is in Frankfurt or Dublin. We do not pretend a region pin is sovereignty. We pin the regions anyway, because the rows should not sit in Virginia “for latency,” and we do not forward beacons to an ads graph. That is the honest version of “made and hosted in the EU.”
The steps
- 1
Read the split, not the slogan
Open /europe. Functions are Frankfurt (fra1). Rows are EU Postgres in Ireland. Both are EU regions. Neither sentence says the vendor is European-owned.
- 2
Check the DPA subprocessors
Open /dpa. Vercel (functions, edge headers) and the EU Postgres host are listed. HMAC of IP + user-agent is still personal data. We do not store the raw IP.
- 3
Know what leaves the region
Email/password stays on this app. Google or X sign-in (Grok hosts only) is those companies. Stripe Checkout for paid plans is Stripe. Those are not the pageview database.
- 4
Say it on your own site
If you write a privacy policy, copy the split: Frankfurt functions, Ireland rows, no raw IP, daily HMAC salt deleted. Do not write “GDPR compliant” as a sticker.
Questions
- Is Cookie Free Analytics European-owned infrastructure?
- No. Prestons Creek Capital is the operator (NL). Hosting is Vercel functions in Frankfurt and Postgres in Ireland. Vercel is a US company. A EU rack does not cancel the CLOUD Act.
- Do pageviews leave the EU?
- The pageview rows do not. Sign-in with Google or X, and Stripe Checkout, are separate products with their own regions.