Privacy
Private by default.
No banner. Ever.
On a PageWeave website your visitors' browsers talk to one party: the platform. Google Fonts, CDN libraries and YouTube embeds are rewritten at render time — the browser never contacts the third party. Analytics runs server-side and cookieless. On every plan, including Free.
No cookies · No third-party scripts · No consent banner · Hosted in the EU
01 — The stack
Six layers, all switched on.
Every layer below ships switched on — on Free, on Pro, on every site. No add-on to buy, nothing to configure.
P.01
Fonts proxied
Google Fonts load from fonts.pageweave.dev. Your visitor's browser never contacts Google — no IP address, no referrer, no font URL shared.
P.02
CDN libraries proxied
Scripts and styles from jsDelivr, unpkg, cdnjs, jQuery, Bootstrap, Font Awesome and Google hosted libraries are rewritten to libs.pageweave.dev — served from an EU disk cache, never straight from the CDN.
P.03
YouTube, click-to-load
Embedded videos become facades: a proxied thumbnail, a notice that names YouTube and the data a click transmits, and a player that loads only after the click. Zero Google requests before it.
P.04
Cookieless analytics
Server-side pageviews with a daily-hashed visitor id, geography and referrer. No cookies, no fingerprinting, no cross-site profile. Working from the first minute.
P.05
Zero cookies, no banner
Public sites set no cookies at all — no session, no analytics, no tracking. There is nothing to consent to, so the banner never ships.
P.06
EU hosting, audited markup
Hetzner servers in Germany, database and file storage in the EU. And at edit time, your agent's HTML is checked for any external resource outside the proxies — before it can ship.
02 — How it works
Rewritten at render. Before the browser sees it.
No plugin, no script, no configuration. The rewriting happens on our servers, while the page is being rendered.
1
Your agent writes normal HTML
A Google Fonts link, a CDN script, a YouTube iframe. Standard web code — nothing special to learn, nothing to swap out.
2
PageWeave rewrites it
Every reference to a covered third-party host becomes a platform proxy URL. Leftover preconnect hints to those hosts are stripped too — they would open a connection that shares your visitor's address for zero benefit.
3
The browser meets one party
Only the platform and its three proxy domains. Google, the CDNs, YouTube — none of them see your visitor's IP address or the page URL until a visitor explicitly chooses to connect.
Edit-time audit
Before anything ships, your agent's HTML is checked for external resources outside the proxies. Anything unusual raises a version warning in the agent's tool response — so nothing third-party slips into your site silently.
03 — Analytics
Numbers, not identities.
You need to know what your website does. You don't need to know who your visitors are.
Recorded
- Page path and referrer domain
- Country, region and city — from a self-hosted GeoIP database
- A visitor hash that resets every day: SHA256 of IP address, browser and date
- Humans and bots, counted separately
- Time on page
Never recorded
- Cookies or device identifiers
- Your visitor's IP address
- A visitor's identity across days or sites
- Fingerprinting signals
- A profile of any person — there is none to sell
Raw page views: 90 days · daily aggregates kept · server-side only
04 — Video embeds
YouTube loads on a click only.
A raw YouTube iframe connects your visitor's browser to Google the moment the page loads — IP address, browser data, page URL. On PageWeave, that connection waits for a click.
YouTube video
Clicking this video or "Load video" connects you to YouTube (Google). Google receives your IP address, browser data, and the address of this page; YouTube may set cookies, and Google may link this data with other data.
YouTube privacy policyThis box held a normal YouTube iframe when the page was written. PageWeave rewrote it before your browser saw it. What you're looking at is what every PageWeave site ships: the thumbnail proxied through the platform, a notice that says exactly what a click transmits, and a player that loads only when your visitor decides to.
Before click: 0 requests to google.com · 1 proxied thumbnail · the click is the visitor's choice
05 — No banner
Nothing stored. Nothing to consent to.
A consent banner exists because something is stored on or read from the visitor's device — European law requires consent for exactly that. PageWeave public sites set zero cookies and store nothing on the device, so the legal trigger never fires.
The video facade follows the same logic in the other direction: the click on the notice is the visitor's consent, taken at the moment it matters, with the disclosure in front of them. Consent is never stored on the device — so no consent platform, no banner state, no script bundle that exists to manage other scripts.
Your visitors get the page. The banner — loudest element on most websites — is absent.
06 — Questions
Asked, answered.
Do I need a cookie banner on a PageWeave site?+
No. Public sites set zero cookies and store nothing on the visitor's device. Analytics is server-side, third-party resources are proxied. With no storage or access on the device, the consent requirement never applies — so there is nothing for a banner to ask.
What happens when a visitor clicks the video?+
The YouTube player loads — that's the point of the notice. Before the click, the facade discloses exactly what happens: the connection to YouTube, the data transmitted, and Google's privacy policy. The click is the visitor's informed decision; afterwards the visit works like any YouTube embed.
What exactly does the analytics record?+
Page path, referrer domain, country and region from a self-hosted GeoIP database, a daily visitor hash — SHA256 of IP address, browser and date, resetting every day — and time on page. No cookies, no raw IP storage, no fingerprinting, no identity across days.
Can I turn the privacy features off?+
The font proxy is always on. The library-CDN proxy and the video facade can be disabled per website if a use case needs a raw third-party embed. The defaults are private; the choice stays yours.
Where is the data stored?+
On Hetzner servers in Germany — Nuremberg, Falkenstein or Helsinki, all inside the EU. Database and file storage included. A German-owned host with no US parent, operated GDPR-native.
Does the Free plan include all of this?+
Yes. Free is the full product: cookieless analytics from the first minute, all proxies included, no consent banner. Free sites live on a pageweave.site subdomain with a badge — that's the difference, and it has nothing to do with privacy.
Begin
Build private from minute one.
Early access is by invitation. Request yours — or read how the platform works first.