piwik is essentially a self-hosted GA. So it uses JS (like GA) but tracks to a DB on your own server so the data on your visit remains private between you and the site-owner (rather than also being provided to a third-party like Google)

Since I can't reply to the reply on this, piwik (the paid version) works just like GA and is offered as a SaaS where they store and analyze the data.

Edit: link: https://piwik.pro

So, it's bad in exactly the same way that GA is bad: it leaks user information to a third party.

Except we're discussing the self-hosted version here ("use whatever you want as long as it's selfhosted").

Yes, that's Piwik Pro. Apparently "Pro" nowadays means a downgrade, or "for simpletons".