100% EU.No fine print.

In most cases yes, but for a different reason than with classic analytics tools. fastmon itself sets no cookies* and, in the default (read-only) mode, stores nothing on the device. The IP address is reduced to a country code at the edge and discarded immediately, query strings are stripped, and there are no long-lived or cross-site identifiers. What remains is read access to browser APIs (the Performance API for Web Vitals, viewport, errors). Under the prevailing interpretation this access falls under § 25 (1) TDDDG and requires consent. The website operator obtains that consent through their consent management platform, exactly as with other tools; the responsibility sits with the operator and is described in our privacy policy (section 5.5). The difference from cookie-based trackers shows at opt-out: if a visitor declines, fastmon measures nothing for that visit, exactly as it should. What does not happen, though: no double-counted users, no orphaned sessions, no distorted unique counts, because fastmon never builds a long-lived or cross-site recognition that could break in the first place. fastmon measures aggregate field performance from a sample, and a smaller sample stays meaningful. So your metrics just get smaller, not skewed, whatever your opt-out rate. With cookie-based tools every opt-out additionally costs you recognition, and with it the reliability of your user numbers.

Exclusively in the EU, on infrastructure operated in Germany. No Cloudflare, no AWS, no GCP, no Vercel, no US-owned sub-processor anywhere in the data path. No provider in the data path is subject to US law, so the US CLOUD Act cannot reach it.

The edge computes a short pseudonymous signal, the stitch, as an HMAC-SHA256 of the IP, User-Agent, a site-specific hash and the domain, under a salt that rotates every 24 hours and never leaves edge memory. It is a one-way HMAC, per-domain and bounded to about 24 hours; it cannot be inverted, and once the salt rotates it cannot be tied back to an IP at all. We treat it as personal data under GDPR Art. 6(1)(f).

Field data: Core Web Vitals, error type and count, device and connection buckets, and country from the IP at the edge. No fingerprinting, no session replay, no reading of page content, no scroll or form capture, no cross-site identifiers, no third-party enrichment. No setting turns on fingerprinting or a cross-site identifier; the presets only change how much context is captured, never whether you can be recognized across sites or over time.

Yes. The Data Processing Agreement is public at fastmon.eu/en/dpa/ and lists every sub-processor in the data path. Questions: privacy@fastmon.eu.

90 days by default; on Enterprise configurable per site up to 13 months. Statistics are kept for 13 months. When retention runs out the rows are dropped, not archived.

Signing in with Google or GitHub is optional. It concerns your login only, never your monitoring data: that always stays on our infrastructure in Germany, no matter how you sign in. If you use social login, you authenticate directly with Google or GitHub, a request you make to their service; we do not route your measurement data there, and the monitoring data path stays US-free. If you would rather not touch a US provider at all, register with email and password; for signing in, your account also supports passkeys, which are device-bound, involve no third party and no password, making them the most private option.