---
title: "Private by default — PageWeave"
---

# Private by default.

No banner. Ever.

On a PageWeave website your visitors' browsers talk to one party: the platform. Google Fonts, CDN libraries and YouTube embeds are rewritten at render time — the browser never contacts the third party. Analytics runs server-side and cookieless. On every plan, including Free.

**No cookies · No third-party scripts · No consent banner · Hosted in the EU**

## The stack — six layers, all switched on

- **Fonts proxied** — Google Fonts load from fonts.pageweave.dev. The browser never contacts Google: no IP address, no referrer, no font URL shared.
- **CDN libraries proxied** — scripts and styles from jsDelivr, unpkg, cdnjs, jQuery, Bootstrap, Font Awesome and Google hosted libraries are rewritten to libs.pageweave.dev, served from an EU disk cache.
- **YouTube, click-to-load** — embedded videos become facades: a proxied thumbnail, a notice naming YouTube and the data a click transmits, and a player that loads only after the click.
- **Cookieless analytics** — server-side pageviews with a daily-hashed visitor id, geography and referrer. No cookies, no fingerprinting, no cross-site profile.
- **Zero cookies, no banner** — public sites set no cookies at all. Nothing to consent to, so the banner never ships.
- **EU hosting, audited markup** — Hetzner servers in Germany; at edit time, agent HTML is checked for external resources outside the proxies.

## How it works

1. Your agent writes normal HTML — a Google Fonts link, a CDN script, a YouTube iframe.
2. PageWeave rewrites it at render time. Every reference to a covered third-party host becomes a platform proxy URL; leftover preconnect hints to those hosts are stripped.
3. The browser meets one party: the platform and its three proxy domains (fonts., libs., thumbs.pageweave.dev). Google, the CDNs and YouTube never see the visitor's IP address or page URL until a visitor explicitly chooses to connect.

An edit-time audit warns the agent about any external resource outside the proxies before anything ships.

## Analytics: numbers, not identities

Recorded: page path, referrer domain, country/region/city (self-hosted GeoIP), a daily visitor hash — SHA256 of IP address, browser and date — humans and bots counted separately, time on page.

Never recorded: cookies or device identifiers, IP addresses, identity across days or sites, fingerprinting signals, any profile of a person.

Raw page views are kept 90 days; daily aggregates stay. Server-side only.

## Video embeds: YouTube loads on a click only

A raw YouTube iframe connects the visitor's browser to Google on page load. On PageWeave, an embedded video becomes a click-to-load facade: proxied thumbnail, a notice naming YouTube and the transmitted data, player on click. Before the click: zero requests to google.com, one proxied thumbnail.

## Nothing stored, nothing to consent to

A consent banner exists because something is stored on or read from the visitor's device. PageWeave public sites set zero cookies — the legal trigger never fires. No consent platform, no banner state, no script bundle managing other scripts.

## FAQ

**Do I need a cookie banner on a PageWeave site?**
No. Public sites set zero cookies and store nothing on the device; analytics is server-side, third-party resources are proxied. The consent requirement never applies.

**What happens when a visitor clicks the video?**
The YouTube player loads — that's the point of the notice. Before the click, the facade discloses the connection, the transmitted data and Google's privacy policy. The click is the visitor's informed decision.

**What exactly does the analytics record?**
Page path, referrer domain, country and region from a self-hosted GeoIP database, a daily visitor hash (SHA256 of IP address, browser and date), and time on page. No cookies, no raw IP storage, no fingerprinting.

**Can I turn the privacy features off?**
The font proxy is always on. The library-CDN proxy and the video facade can be disabled per website. Defaults are private; the choice stays yours.

**Where is the data stored?**
On Hetzner servers in Germany — Nuremberg, Falkenstein or Helsinki, all inside the EU. German-owned host, no US parent, GDPR-native operation.

**Does the Free plan include all of this?**
Yes. Free is the full product: cookieless analytics from the first minute, all proxies included, no consent banner.

---

Hosted on Hetzner in Germany · Raw analytics data 90 days · Details: https://pageweave.dev/docs/privacy.md · Legal: https://pageweave.dev/privacy