Cycling through all six. Tap any point to stop.

Measured on six things

Privacy-first, cookieless web analytics that ties your traffic to real revenue.

Security

HTTP probe shows HTTPS not enforced, no HSTS, no CSP, no frame protection, no secure cookies — 2/13 checklist points. SPF and DMARC are present, but the header posture is thin for a privacy-first product.

Screenshots

1 / 1

Orlyn

About this app

Orlyn is privacy-friendly web analytics for founders and SaaS teams who care about revenue, not vanity metrics. Connect Stripe in one click to tie website visits and marketing channels to real paying customers, install a sub-1KB script in under two minutes, and understand which journeys convert. Orlyn is cookieless and designed for GDPR, CCPA, and PECR compliance, so you can eliminate cookie consent banners. It includes live visitor journeys, AI-powered referrer and campaign insights, Core Web Vitals monitoring, and a concise morning brief.

Key features

1One-click Stripe connection tying website visits and marketing channels to real paying customers
2Cookieless tracking designed for GDPR, CCPA, and PECR compliance — no cookie consent banner needed
3Sub-1KB script with live visitor journeys, AI referrer insights, Core Web Vitals, and a morning brief

Target customer profile

Drawn from the product itself, not from a survey.

Demographic

Founders and SaaS teams

Pain points

Cannot see which channels drive paying customers; cookie banners

Primary needs

Revenue attribution, simple privacy-friendly analytics

Demographic

Indie hackers and marketers

Pain points

Vanity metrics, heavy analytics scripts

Primary needs

Lightweight script, live visitor journeys

Demographic

Privacy-conscious businesses

Pain points

GDPR/CCPA compliance burden

Primary needs

Cookieless tracking without consent banners

Scout Review

Written by AI from measured evidence, scored out of 100.

Orlyn is a privacy-friendly, cookieless web analytics tool aimed at founders and SaaS teams who want to see which channels actually produce paying customers. The pitch is sharp: connect Stripe in one click, install a sub-1KB script, and skip the cookie banner. The landing page is polished, the dashboard mockup looks product-real, and the comparison table against Google Analytics, Plausible, and Fathom does its job. Speed is genuinely excellent — 94 mobile, 98 desktop on Lighthouse. But the security posture is thin for a privacy-first product: HTTPS isn't enforced, and there's no HSTS, CSP, or secure cookies. Accessibility is strong on automated checks but fails contrast and heading order. Growth rests on a real wedge (Stripe attribution) in a crowded category. A promising early-stage tool with a clear identity and a couple of gaps worth fixing before it asks anyone to trust it with their data.

Measure by measure

Usability

Clear repeated free-trial CTA, simple nav with a Docs escape hatch, and scannable feature cards. No third-party reviews exist to verify onboarding speed or the claimed two-minute install.

Design

Polished landing page with a product-real dashboard mockup, consistent purple accent, and a scannable comparison table. Held back by low-contrast trusted-by logos and repetitive light-gray card stacking.

Speed

Lighthouse mobile 94/100 (LCP 2.9s, CLS 0.001, TBT 0ms) and desktop 98/100. Genuinely fast, though the sub-1KB script claim is unverified independently.

Security

Accessibility

Lighthouse accessibility 95/100, but two real failures: insufficient color contrast and non-sequential heading order. No accessibility statement or WCAG conformance claim published.

Growth

Real problem (channel-to-revenue attribution), specific customer (founders/SaaS), and a concrete wedge (Stripe connect + cookieless). Differentiated but not yet defensible against Plausible/Fathom.

Improvement areas

Security headers: HTTPS not enforced, no HSTS, CSP, frame protection, or secure cookies (2/13 checklist points)
Accessibility: Lighthouse fails on color contrast and heading order; no accessibility statement published
Third-party trust signals: no reviews, no security page, no audit or pen-test disclosure

Design & Usability

Orlyn's landing page is competently built: a realistic dashboard mockup with actual tables and chart data, a consistent purple accent, and a comparison table that does the positioning work in nine rows. The visual audit flags low-contrast trusted-by logos and a long stack of near-identical light-gray cards that make the scroll feel repetitive. Usability signals are decent — a repeated high-contrast free-trial CTA, a simple nav with a Docs link, and scannable feature cards. What's missing is any third-party verification: no reviews, no onboarding walkthroughs, nothing to confirm the 'two-minute install' claim. The product looks like it knows what it is; it just hasn't been stress-tested by anyone outside the maker's browser.

Speed & Security

Speed is Orlyn's strongest measured dimension. Lighthouse mobile performance lands at 94/100 with LCP 2.9s, CLS 0.001, TBT 0ms, and FCP 1.2s; desktop hits 98/100. The sub-1KB script claim is plausible given those numbers but not independently benchmarked. Security is the opposite story. The HTTP probe shows HTTPS not enforced, no HSTS, no CSP, no frame protection, no X-Content-Type-Options, no Referrer-Policy, no Permissions-Policy, and no secure cookies — 2/13 checklist points, with only SPF and DMARC present. For a product whose entire pitch is privacy and compliance, that header posture is a real gap, not just an unverified one.

Accessibility & Growth

Accessibility scores 95/100 on Lighthouse but fails two real audits: insufficient color contrast and non-sequential heading order. No accessibility statement or WCAG conformance claim is published, so the automated score is all we have to go on. Growth is a judgement on the idea: Orlyn names a real problem (which channels drive paying customers, not vanity metrics), targets a specific customer (founders and SaaS teams), and has a concrete differentiator — one-click Stripe connection tying visits to revenue, plus cookieless tracking that removes the consent banner. That wedge is real, but the category is crowded with Plausible and Fathom, and nothing in the material shows a moat they structurally can't copy. The domain is brand new and only Twitter is listed as a social profile, so traction is context, not score.

Conclusion

Orlyn has the shape of a product that could work: a specific customer, a real pain point, a differentiator that the incumbents don't lead with, and a fast, clean site. What it doesn't yet have is the trust infrastructure that privacy-first analytics buyers actually look for — enforced HTTPS, security headers, an accessibility statement, and any third-party signal that someone other than the maker has used it. None of that is fatal at this stage, and the Stripe-to-revenue angle is the kind of wedge that can carry a product if it's executed well. Fix the headers, publish a security page, get a few real users talking, and the rest of the pitch starts to hold up. Until then, it's a good-looking bet with an unproven hand.

Suggestions for improvement

Enforce HTTPS and add HSTS, CSP, X-Content-Type-Options, Referrer-Policy, and secure cookies — a privacy product can't ship without them.
Publish a security page with data handling details, subprocessors, and any audit or pen-test status, even if it's just 'not yet audited.'
Fix the two Lighthouse accessibility failures: raise contrast on the trusted-by logos and correct the heading order.
Add an accessibility statement and WCAG conformance target; automated 95/100 is a starting point, not a claim.

How we score

Alternatives comparison

Named competitors, point by point. Nobody paid to appear here or to be left out.

	Orlyn	Google Analytics	Plausible	Fathom Analytics
Pricing model	14-day free trial; paid tiers (pricing not fully detailed on site)	Free with GA4; paid via Google Ads/360	Paid subscription, no free tier; 30-day trial	Paid subscription, no free tier; 30-day trial
Cookie consent required	No — cookieless, designed for GDPR/CCPA/PECR	Yes — cookie-based, consent banner typically required	No — cookieless by design	No — cookieless by design
Revenue attribution via Stripe	Yes — one-click Stripe connect ties visits to paying customers	Partial — ecommerce tracking requires manual setup, not Stripe-native	No native Stripe revenue attribution	No native Stripe revenue attribution
Script size	Sub-1KB (claimed)	~45KB+ gtag.js	<1KB	~2KB
Core Web Vitals monitoring	Yes — built-in	Yes — via Search Console / CrUX	Yes — via separate integration	Limited
Security posture (headers, audits)	HTTPS not enforced; 2/13 header checklist; no published audit	Enterprise-grade; SOC 2/ISO via Google Cloud	HTTPS enforced; GDPR-focused; no public SOC 2	HTTPS enforced; GDPR-focused; no public SOC 2