Growth Teardown #2: How Fathom Analytics Built a $1M+ Business by Timing GDPR

On April 16, 2018, Paul Jarvis posted a mockup on Twitter. He wanted to know if anyone would use a simpler analytics tool, one that showed you what you needed and nothing else. The response was enough that within two weeks he had a technical cofounder. Within six weeks they had an open-source project. Within eight weeks they had a Product Hunt launch that finished second on the day.

Thirteen days after that open-source release, GDPR went into effect across the European Union.

The timing looked like genius. It was partly conviction, partly execution, and partly the kind of luck that only shows up when you have built the right thing and shipped it fast enough to matter.

Fathom Analytics is a privacy-first website analytics tool. No cookies, no consent banners required, no personal data sent to US servers. It has grown to an estimated $1M+ per month in revenue with no outside investors, no ads, and a team that has stayed in the single digits for eight years. This is the second entry in the Growth Teardown series: a close look at what actually drove Fathom's numbers, how they held the company together through a near-shutdown, and what solo founders can take from it. If you are still building toward your first 100 users, the first 100 users guide is the better starting point. This post is the long-arc playbook.

What is Fathom Analytics, exactly?

Fathom is a website analytics tool built around one premise: you should be able to understand your site's traffic without collecting personal data, setting cookies, or forcing visitors to click a consent banner.

The dashboard is one page. You get visits, page views, bounce rate, referrers, top pages, devices, and goal conversions. No segments, no funnels, no data exploration interface designed for analysts running SQL queries. The product deliberately gives you less, and for most founders and small teams, that constraint is exactly right.

Pricing starts at $15 per month for 100,000 page views across 50 sites, with no data retention limits. Notable customers include IBM, GitHub, HashiCorp, the New York Times, Laravel, and Bootstrap. Bootstrapped from day one, Canadian-incorporated (a GDPR adequacy country, which matters for the story ahead), and owned 100 percent by Jack Ellis since December 2024.

How did a tweet and a mockup start a $1M analytics company?

Paul Jarvis posted the mockup. Danny van Kooten, a Dutch developer who had built MC4WP (a WordPress plugin with more than two million active installs), saw it and responded. Within two weeks they had agreed to build it together.

The open-source version launched publicly on May 12, 2018, thirteen days before GDPR's enforcement date. It hit 6,000 GitHub stars within a few months. The Docker image was pulled more than a million times. On June 12, Fathom launched on Product Hunt as a hosted service, finishing second on the day with 80 upvotes. The paid Fathom Pro hosting followed in September.

The speed of that sequence matters. Tweet to open-source in two weeks. Open-source to Product Hunt in a month. Hosted product two months after that. In a space where privacy concerns were about to become legally urgent for every website owner in Europe, Fathom was live and building a reputation before most competitors had a pitch deck.

This was not pure luck. Paul had spent years writing about the ethics of data collection and the downsides of surveillance-based advertising. The privacy-first positioning was not a pivot; it was the founding premise. GDPR arriving two weeks after the open-source launch compressed what might have taken years of slow market education into an immediate "we need this now" moment for thousands of website owners.

Why did GDPR turn into a growth engine instead of just a compliance headache?

GDPR went into effect on May 25, 2018. The short version of what it required: European users have the right to know what data you collect about them, why you collect it, and who you share it with, and the right to refuse. For website analytics, that meant tools like Google Analytics (which set cookies and transferred data to US servers) needed explicit visitor consent or had to be replaced.

Most website owners did not immediately understand the implications. But over the following years, EU regulators made them explicit. In January 2022, the Austrian Data Protection Authority ruled that the use of Google Analytics violated GDPR because it transferred data to US servers where EU citizens had no legal recourse against government surveillance. France, Italy, and Denmark followed with similar rulings. Each one sent a fresh wave of site owners searching for alternatives.

When the Austrian ruling landed, Fathom was ready. They published a post called "Is your analytics software illegal?" It was direct, specific, and appeared at the exact moment thousands of site owners were looking for answers. Jack Ellis later said that March 2022 was the best stretch Fathom had ever had for signups, with MRR growth tripling in the weeks that followed.

That result was not accidental. Fathom had published detailed content about EU data isolation and Schrems II compliance before the Austrian ruling. They had built an EU Isolation feature that routes EU visitor data through servers in Germany and Finland without ever touching US infrastructure. When regulators moved, Fathom was already positioned as the authoritative answer, not as one of many companies scrambling to catch up.

The playbook: pick a direction you believe regulators are moving toward, build the product that would be correct when they arrive, and publish the content that explains why before anyone starts searching for it. GDPR was announced two years before its enforcement date. The direction was clear. Fathom treated it as a brief.

How did Paul Jarvis's newsletter become Fathom's first sales team?

Before Fathom, Paul Jarvis was known for his newsletter, The Sunday Dispatches. He had been writing it for years, and by 2018 it had around 30,000 to 35,000 subscribers, mostly designers, freelancers, and small business owners who followed his work. He also had a book in progress: "Company of One," published by HarperCollins in January 2019 and eventually translated into more than 20 languages.

When Paul announced Fathom to his list, the first paying customers came from that email. No ads. No cold outreach. No referral incentive. One email to people who already trusted him, offering them something that aligned with what he had been writing about for years.

"Company of One" arriving in early 2019 brought a second wave. The book's argument (that building a small, sustainable business is a legitimate and often superior alternative to scaling for its own sake) resonated with exactly the kind of people who would pay for privacy-respecting analytics from an indie team rather than continuing to use a free enterprise tool. Paul's audience and Fathom's product were aligned at the values level, not just the feature level.

That alignment is worth pausing on. Founder distribution is not just about reach. Paul's 35,000 subscribers were not a generic purchased list; they were a community he had built over years by consistently writing things worth reading. The trust he had with that audience converted in a way that a bought list of the same size never would. If you are building a product without simultaneously building an audience for it, you are compounding one asset while ignoring another.

Why did Fathom nearly shut down in 2018, and what actually saved them?

Danny van Kooten left Fathom in December 2018, about six months after launch. He had a new baby and MC4WP was generating significantly more revenue than Fathom at the time. The departure was announced publicly in March 2019, but the decision came quietly at the end of the year. Fathom was close to being abandoned entirely.

Jack Ellis was a self-taught developer who had been working with Paul on a separate project called Pico. When he heard about Danny's departure, he offered to step in. He was not a contingency plan; he was someone who believed in the product and had the skills to take it forward.

What Jack did next changed the trajectory. He rebuilt Fathom's infrastructure from the ground up on a serverless stack using Laravel Vapor. The architecture could handle major traffic spikes without degrading, which turned out to matter enormously when EU regulatory events started driving sudden surges in signups.

The rebuilt product launched as Fathom V2 in October 2019. Alongside it, Paul and Jack launched Above Board, a podcast about running a transparent bootstrapped business. They talked openly about decisions, tradeoffs, and the mechanics of keeping a small company healthy, without ever publishing revenue figures. The podcast was a bet on storytelling as a marketing channel: if you tell the real story honestly and consistently, you attract the kind of customers who want to support that kind of company.

MRR tripled after V2. Jack quit his day job in early 2020 to run Fathom full-time. The near-shutdown story, published honestly while the outcome was still uncertain, became one of their most-read pieces and was cited repeatedly across the indie founder community as an example of transparency that actually builds trust rather than just performing it.

Worth naming directly: the story of almost quitting did more for Fathom's credibility than most product milestones would have. Founders read it and trusted them more, not less.

How did Fathom replace a marketing team with one well-timed blog post?

The "Is your analytics software illegal?" post is the clearest example in Fathom's history of what news-event content can do. It was not built around a keyword. It was not evergreen. It was written because a major regulatory ruling created an urgent, specific question for tens of thousands of site owners, and Fathom was the best-positioned company to answer it.

A few things had to be true for that post to work:

They had to be early. Fathom had published detailed content about EU data isolation and GDPR compliance before the Austrian ruling. When the ruling hit and people searched for answers, Fathom's older content already had authority. A company publishing its first GDPR post the week of the ruling would have been too late to capture the same spike.

The product had to match the moment. A post that says "our product is GDPR-compliant" does not work if the product is still catching up to the regulatory standard. Fathom's EU Isolation feature, which routes EU visitor data through European servers only, was the exact answer to the Schrems II concern. The content worked because the product was already correct.

The channel is repeatable. Every major EU privacy ruling creates the same pattern: confusion, urgency, and searches for solutions. Fathom has been ready each time. That preparation is a deliberate content strategy built around where the regulatory environment is heading, not around what happens to be trending today.

Supporting all of this: an affiliate program that has paid out more than $100,000 in commissions since launch, with 25 percent recurring on every referral. Jack also built a following in the Laravel and serverless development community through his own technical writing and a paid course on serverless infrastructure. That developer audience overlapped directly with the kind of people building their own projects and looking for analytics that treated their users' data responsibly.

What are Fathom's actual growth numbers?

One thing to establish upfront: Fathom does not publish revenue publicly. They recorded a podcast episode making the case against the open startup trend, arguing that sharing MRR is ego performance that also telegraphs your pricing ceiling to competitors. What we have is a timeline reconstructed from public milestones, interviews, and what they have chosen to share:

Year	Milestone
Apr 2018	Paul Jarvis tweets a mockup; Danny van Kooten responds
May 2018	Open-source launch, 13 days before GDPR takes effect
Jun 2018	Product Hunt: #2 of the day, 432 upvotes
Sep 2018	Fathom Pro (paid/hosted) launches
Dec 2018	Danny van Kooten exits; Fathom nearly shuts down
Early 2019	Jack Ellis joins as technical cofounder
Jan 2019	"Company of One" published; second audience wave
Oct 2019	V2 on serverless launches; MRR triples
Early 2020	Jack quits his day job to run Fathom full-time
Jan 2022	Austrian DPA rules Google Analytics violates GDPR
Mar 2022	Best signup weeks ever; MRR growth triples
Oct 2023	Affiliate program crosses $100,000 in commissions paid
Dec 2024	Paul Jarvis retires; Jack Ellis acquires 100% of Fathom

The $1M+ per month figure comes from Starter Story, where it is user-reported and not independently verified. Treat it as an order of magnitude, not a confirmed number. What is documented: the V2 launch tripled MRR, and the January 2022 Austrian ruling drove what Jack described as the best growth stretch in Fathom's history. The business has been self-sustaining and profitable since at least 2020, when Jack felt confident enough to leave his day job.

What can solo founders learn from Fathom?

The Carrd teardown was about a product that caught three accidental viral waves. Fathom's story is different. It is mostly about deliberate positioning, deliberate content, and a deliberate refusal to grow faster than the team could handle.

Regulatory timing is a real growth channel. You do not have to predict a specific ruling. You have to look at the direction regulators are moving, build the product that would be correct when they arrive, and be ready with content when the moment comes. GDPR was announced two years before its enforcement date. The direction was clear. Fathom positioned itself early and reaped the benefit when the moment arrived.

An existing audience is worth more than any ad budget on launch day. Paul's newsletter did not appear overnight. It was the result of years of consistent writing for a specific community. If you are building a product without simultaneously building an audience for it, you will do a cold launch. That is survivable but harder than it needs to be, and you are leaving a compounding asset on the table.

Near-death honesty compounds into trust. When Danny left and Fathom almost shut down, Paul and Jack published the story while it was still unresolved. They did not wait until they were safely on the other side to frame it as a comeback. That kind of transparency attracts customers who stay loyal even when a competitor has a cheaper plan or a longer feature list.

News-event content beats evergreen SEO for spiky growth. Fathom's biggest traffic moments came from being ready with the right post when a regulator moved, not from ranking for "best Google Analytics alternative." Both channels matter; most founders only work on one of them.

Build the company brand separate from the founder early. Paul had a substantial personal audience, but he and Jack deliberately built @usefathom as its own brand rather than positioning Fathom as Paul Jarvis's analytics tool. When Paul left Twitter in 2020 and retired from the company in 2024, Fathom's growth continued without disruption. That resilience is only possible if you start separating brand from founder before you need to.

The bottom line

Fathom's growth is the result of a few decisions held consistently over eight years:

• A product built on the right side of a regulatory direction before that direction became a legal requirement
• A cofounder with real distribution who converted existing trust into early customers without spending a dollar on ads
• Near-death transparency that built more credibility than any polished launch announcement could
• Content written for the moment regulators move, not for abstract keyword rankings
• A company brand built separately from its founders' personal profiles, so the business could outlast any individual's presence

Three things went seriously wrong in the first six months: the original technical cofounder left, the company nearly shut down, and the infrastructure had to be rebuilt from scratch. Fathom published all of it. That honesty is not separate from the growth story; it is part of why the company has the reputation and the loyal customer base it does today.

If you are trying to find the equivalent timing window in your own space, the question worth sitting with is this: what regulatory or cultural direction is already visible but not yet legally enforced? Build for where that direction leads, get there early, and be ready with content when the moment arrives.

That research is part of what GrowthMap is built to accelerate: competitor data, audience analysis, and outreach targets based on real signals, so you can figure out where your version of Fathom's GDPR moment might be hiding before someone else finds it first. If you are earlier in the journey and need the tactical playbook for getting in front of your first users, the first 100 users guide is the right next read.