“Open source” shows up on GA4-alternative lists as if it were a privacy control. It is a licence and a deployment model. Matomo (on-prem or cloud), Umami, Countly, and Plausible’s AGPL codebase let you read the tracker. They do not empty your on-call rotation, import Search Console for you, or make a first-party cookie disappear — Matomo can still set one if you configure it that way.
SiteLine is not open source and is not self-hosted. If your procurement requirement is “we run the binary”, stop here and pick Matomo or Umami. If the requirement is “no analytics cookie, query-level organic history, an MCP server”, keep reading. The privacy-first comparison covers hosted cookieless vendors; this page is the self-host fork in the road.
What you actually take on
Self-hosting web analytics means you own:
- TLS, upgrades, plugin CVEs (Matomo’s plugin ecosystem is large for a reason).
- Bot filtering that is not someone else’s default list.
- Backups of hit-level data that a court can ask for, because you are now clearly the controller with the disk.
- A collect endpoint that ad blockers may still hit if you leave the default path names.
- Whatever Google API client you write to replace the Search Console UI’s 1,000-row, 16-month window.
That last bullet is the one marketing pages skip. Open-source analytics products count your pageviews. They do not, by default, backfill 16 months of Search Console, re-import the last 7 days because Google revised Tuesday, or cap each dimensional report at 25,000 rows per day without silently truncating a range. You can build that. It is a product. SiteLine is that product, hosted, read-only webmasters.readonly.
Cookie ≠ licence
| Stack | Licence / deploy | Typical identity | Search Console | You run the servers? |
|---|---|---|---|---|
| GA4 | Proprietary, hosted by Google | First-party cookie | Separate Google UI | No |
| Matomo self-host | GPL-ish, you run it | Cookie or cookieless, depending on config | DIY or extra | Yes |
| Matomo Cloud | Hosted by Matomo | Same family | Not SiteLine’s importer | No |
| Umami | MIT, self-host or their cloud | Lightweight; check current cookie behaviour | DIY | Often yes |
| Plausible CE | AGPL, self-host | Cookieless by design | Not the 16-month keeper | Yes if CE |
| SiteLine | Proprietary hosted | Daily hash, no analytics cookie | 16-month backfill, 25k/day, kept while subscribed | No |
Read the current docs for Umami and Matomo before you assert “cookieless” in a DPIA — both have moved, and self-host defaults differ from cloud. SiteLine’s behaviour is specified: no first-party analytics cookie, credentials: 'omit', SHA-256 of truncated IP (/24 IPv4, /48 IPv6) + UA + daily salt, UTC midnight reset, raw IP not stored on the event, hostname allowlist, bots filtered. Details: /docs/privacy.
First-party collect is not a CNAME product
Open-source installs often sit on analytics.yourapp.com. That is a first-party hostname you control. SiteLine v1 does not manage CNAMEs for you. You may reverse-proxy /js/script.js and POST /api/analytics/event to the SiteLine origin — nginx, Caddy, Cloudflare Worker, Vercel rewrites — as documented in /docs/proxy. That is the same idea as hosting Umami on your domain, with a different ops surface: you maintain two proxy locations, not Postgres.
If you wanted to self-host SiteLine, you cannot. That is a limitation, not a roadmap tease on this page.
When self-host is the right call
Choose self-host when data residency means your disk, when legal forbids a US/AU processor, or when you already operate Matomo for ten properties and the muscle memory is paid for. Choose it when you need plugins SiteLine will not build: session replay, heatmaps, intranet auth overlays, Mixpanel-class product analytics.
Do not choose self-host because a blog said it is more private. A Matomo instance that still sets a cookie and has open plugin RCE is not a privacy win. A hosted cookieless tracker with a published hash scheme and a DPA can be easier to explain.
SiteLine pricing if you stay hosted: $4.99 / 1M, $19.99 / 10M, $99.99 + $2.99 / extra 1M, 7-day trial with card, ~50k trial visibility, soft cap on Starter/Growth, 30-day analytics grace, unlimited domains, MCP for Claude / ChatGPT / Cursor. Goals derived, not billed twice (/docs/goals). Packages @siteline.tools/tracker and @siteline.tools/react.
Related: SiteLine vs Google Analytics, privacy-first analytics comparison. Signup: /register.
FAQ
Is Plausible “open source” the same as Plausible Cloud?
No. Community Edition is AGPL and self-hosted. Plausible Cloud is their hosted product with a different contract. Feature parity is not guaranteed. Read their current docs; this page will not pretend to version-pin them.
Can I export SiteLine events into my own Umami?
There is no BigQuery-style stream and no self-host mirror. CSV export exists. If you need hit-level ownership on your disk, self-host something else from day one.
Does open source avoid Google as a processor?
Only for on-site hits you collect yourself. Search Console data is still Google’s. SiteLine’s GSC import makes that copy explicit. A self-host analytics box that never talks to Google simply omits query-level SEO, which is a product hole, not purity.