Compare nilly and Trackboxx on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Fathom Analytics, Google Analytics
Switzerland· Web Analytics
Needs review
Shortlist nilly when you want Swiss-entity, cookieless, ultra-light site analytics with realtime dashboards, city geo, custom events, unlimited sites, and an API—without GA4 consent weight. Skip when you need self-host/open source, enterprise audit packs, or deep marketing-suite analytics; consider Plausible Analytics, Simple Analytics, or etracker instead.
Germany· Web Analytics
Needs review
Shortlist Trackboxx when you want German-operated, cookie-free hosted analytics with ecommerce and agency-friendly public dashboards. Skip when you need self-host/open-source control or GA-class product analytics—consider Plausible (self-host option) or Matomo instead.
Highlighted rows differ between the two products.
| Feature | nilly | Trackboxx |
|---|---|---|
| Country of origin | Switzerland | Germany |
| Category | Web Analytics | Web Analytics |
| Open source | No | No |
| Self-hosted | No | No |
| Headquarters | Switzerland | Germany |
| Legal entity | Lyo GmbH, Europaallee 41, 8004 Zürich (CHE-417.675.763) | Trackboxx / Christian Pust (sole trader imprint; Halberstadt seat, Grönwohld branch) |
| Governing law | Switzerland (terms) | Not listed |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Medium |
| Hosting / residency | Vendor FAQ: analytics servers in Switzerland (multiple locations). Public site reverse-DNS: KreativMedia/METANET Zürich. Customer-account subprocessors named in privacy policy: Stripe (US payments), Mailerlite (email). Avatars via Gravatar. No full public subprocessor list for backups/monitoring/CDN. | Visitor analytics: TK Enterprises Ltd infrastructure in First Colo Frankfurt. CDN: BunnyWay d.o.o. (Slovenia). Payments: Paddle.com Market Ltd (UK). Email/newsletters: Amazon SES (AWS; EU regions primary, possible US). Chat on marketing site: Userlike UG (Germany). |
| Summary | Swiss privacy-first web analytics (Lyo GmbH): cookieless, sub-1kB tracking with realtime dashboards, city-level geo, custom events, unlimited sites, and a REST API as a lightweight Google Analytics alternative. | German cookie-free web analytics SaaS: day-rotating hash tracking, ecommerce and UTM dashboards, hosted analytics in Frankfurt with a published B2B DPA. |
| Tags |
| At a glance | nilly | Trackboxx |
|---|---|---|
| HQ | Zürich, Switzerland (Lyo GmbH) | Halberstadt / Grönwohld, Germany |
| Legal entity | Lyo GmbH (CHE-417.675.763) | Trackboxx / Christian Pust (imprint) |
| Product model | SaaS web analytics (not self-hosted) | Not listed |
| Tracking | Cookieless; no IP/fingerprint claims | Not listed |
| Hosting (claimed) | Switzerland (multi-site) | Not listed |
| Commercial model | Traffic-based plans; trial; no permanent free tier | Pageview packages; free tier + trial; Paddle checkout |
| Live site note | kandur.one (nilly branding; nilly.io DNS failed at research) | Not listed |
| Product type | Not listed | Managed web analytics SaaS |
| Open source | Not listed | No |
| Self-host | Not listed | No |
| Analytics hosting | Not listed | First Colo, Frankfurt (via TK Enterprises Ltd) |
| Key capabilities | nilly | Trackboxx |
|---|---|---|
| Cookieless tracking | Yes | Not listed |
| Swiss-hosted (claimed) | Yes | Not listed |
| Swiss entity | Yes | Not listed |
| Sub-1 kB script | Yes | Not listed |
| REST API | Yes | Not listed |
| SaaS only | Yes | Yes |
| Cookie-free tracking | Not listed | Yes |
| Germany-operated | Not listed | Yes |
| Frankfurt analytics hosting | Not listed | Yes |
| E-commerce analytics | Not listed | Yes |
| B2B DPA available | Not listed | Yes |
Sub-1 kB cookieless tracking script
Vendor documents a client script under 1 kB with no cookies, no IP tracking, and no fingerprinting for site visitors. Suited to teams that want aggregate traffic metrics without analytics cookie banners; still get counsel for your jurisdiction and CMP setup.
Realtime dashboard with geo, tech, and campaigns
Dashboards cover live visitors, overview metrics, top pages, referrers, UTM campaigns, geography from continent to city, and device/browser/OS breakdowns—enough for content and acquisition decisions without a full product-analytics suite.
Custom events, CSV export, and email reports
Define custom events for conversion-style actions, export statistics as CSV, and receive email reports. Fits operators who need lightweight conversion signals and offline analysis rather than session replay or multi-step funnels.
REST API for stats, websites, and account
Documented API endpoints (Bearer API key) manage stats queries (pageviews, visitors, referrers, events, geo, devices, and more), websites, and account objects—useful for internal dashboards or automations on traffic-based plans that include API access.
Unlimited websites on traffic-based plans
Public pricing model is pageview-tier SaaS with unlimited websites per account and a short free trial—not a permanent free tier. Good for agencies or multi-brand operators who outgrow per-site free plans elsewhere; confirm current tiers on the vendor site.
Cookie-free day-hash session tracking
No analytics cookies. Same-day visitor correlation uses hashes of IP, user agent, site ID, and a daily rotating signature (page hashes also include host/path). Hashes expire within 24 hours so multi-day visitor histories and IP recovery are not available by design.
Traffic, channel, and live visitor dashboards
Dashboards cover visits, pageviews, bounce rate, dwell time, devices/browsers, geo down to city, channel mix including AI traffic, outbound link clicks, live visitors on a short refresh interval, and period-over-period comparisons without a heavy analyst UI.
E-commerce funnels and revenue breakdowns
Shop metrics include products sold, cart abandonment, add-to-cart style signals, checkout funnel visibility, and revenue by channel and location—aimed at operators who need store KPIs without a full GA4 ecommerce implementation.
UTM, goals, GSC keywords, and public reports
Campaign UTMs, conversion goals (including auto goals), optional Google Search Console keyword views, shareable public dashboards (URL or iframe), and PDF reports support marketers and agencies who need client-facing summaries.
CMS and shop plugins plus GA import
Documented integrations include WordPress, Shopware, Shopify, JTL, and ePages. Help center also covers script install, excluding own IP/paths, ads tracking patterns, and importing historical Google Analytics data when migrating.
| Assurance & compliance | nilly | Trackboxx |
|---|---|---|
| Independent security / no-logs audit | Not found No public third-party audit report found for tracking claims. | Not found No public third-party audit PDF or cert registry entry found on primary pages. |
| ISO 27001 | Not found No vendor ISO 27001 certificate published on product site (underlying Swiss host DCs may be certified separately). | Not found No ISO 27001 claim found on imprint, help center, or DPA materials reviewed. |
| SOC 2 / SOC 3 | Not found | Not found No SOC 2/3 report referenced on public trust materials reviewed. |
| GDPR / EU data protection | Vendor claimed Swiss entity; privacy policy includes GDPR rights language; cookieless visitor tracking claimed. Confirm DPA for B2B. | Vendor claimed German controller imprint; cookie-free hash model; public DPA; processing described as EU/EEA. Vendor asserts DSGVO fitness—confirm with counsel for your site stack. |
| US CLOUD Act exposure (indicative) | Partial Swiss operator, no known US parent, Swiss-claimed analytics hosting; US SaaS subprocessors Stripe (payments) and Gravatar (avatars) on customer path. Not legal advice. | Partial EU sole-trader operator, no known US parent; analytics hosting claimed in Frankfurt. Partial/medium because privacy policy names Amazon SES (AWS) for email with possible US transfers; payments via UK Paddle. Not legal advice. |
| Data processing agreement (B2B) | Not found No public DPA download found; request from vendor. | Vendor claimed Free AV/DPA offered at order and as PDF; annex lists hosting, Paddle, BunnyWay. |
| EU AI Act | Not applicable Web analytics product; not marketed as an AI system. | Not applicable Web analytics SaaS; not an AI system product for AI Act high-risk classification purposes. |
| Swiss Made Software / Swiss Web labels | Vendor claimed Cited on About and Swiss Union member page as recognition/labels—not a security audit. | Not listed |
| Considerations & known limitations | nilly | Trackboxx |
|---|---|---|
| Brand/domain transition (nilly.io vs kandur.one) | Medium Product still branded nilly, but the live marketing/API host is kandur.one; nilly.io did not resolve in DNS during research. Verify tracking domains, docs, and status before production cutover. | Not listed |
| US SaaS on customer account path | Medium Stripe (payments) and Gravatar (avatars) are US-group services. Visitor metrics are claimed Swiss-hosted and non-personal, but account/billing data is not Switzerland-only end-to-end. | Not listed |
| Thin public assurance pack | Medium No public ISO 27001/SOC 2, independent security audit, or DPA page found. Fine for many SMB shortlists; friction for regulated enterprise questionnaires. | Not listed |
| No self-host or open-source edition | Low Cannot run on your own infra or audit server code from a public repo. Hard limit for sovereignty programs that require self-host. | Low Managed SaaS only. Policies that mandate customer-operated infrastructure need a different product. |
| Small independent operator | Low Founder-owned Swiss GmbH without VC narrative—positive for independence, but buyers should assess support SLAs, roadmap continuity, and single-vendor concentration. | Not listed |
| Consent banner claim is vendor legal opinion | Not listed | Medium Trackboxx argues legitimate interest and no opt-in for its cookie-free tracker alone, while noting some DPOs disagree. Other tags on the site can still force banners. Treat as diligence input, not a legal certificate. |
| Amazon SES on email path | Not listed | Medium Privacy policy discloses AWS SES for system/newsletter email with possible US transfers. Distinct from Frankfurt analytics storage, but raises residual US-group process exposure for account communications. |
| No public ISO/SOC/independent audit | Not listed | Medium Procurement teams that require cert packs will need questionnaires, DPA annex review, and possibly NDA materials beyond the public site. |
| Same-day hash limits multi-day user journeys | Not listed | Low By design you cannot rebuild long-lived individual visitor histories across days. Teams needing identity-resolution analytics will find this a hard product limit. |
When: You want open-source and/or self-host privacy analytics with a larger community
Consider: Plausible Analytics or Pirsch Analytics
nilly is proprietary SaaS only.
When: You want another European cookieless SaaS with a simple product story
Consider: Simple Analytics
Dutch peer; compare geo depth, API, and residency claims side by side.
When: You need deeper marketing, shop, and tag/consent analytics for EU enterprises
Consider: etracker
German suite-oriented alternative; heavier than nilly's lightweight dashboard.
When: You depend on free unlimited scale and Google ads/ecosystem integration
Consider: Google Analytics (GA4)
Different privacy and residency tradeoffs; not a sovereignty shortlist.
When: You need cookieless EU analytics with an official self-host path
Consider: Plausible Analytics (Cloud or Community Edition)
Trade Trackboxx ecommerce/plugin depth for open-source deployability.
When: You want maximal privacy minimalism and a very small surface area
Consider: Simple Analytics
Simpler feature set; less ecommerce and shop-plugin emphasis than Trackboxx.
When: You need deep self-hosted analytics or on-prem control
Consider: Matomo or Piwik PRO-class platforms
Heavier ops and UI; stronger fit for full data residency under your infrastructure.
When: You depend on Google Ads identity graphs, Audiences, and free unlimited scale
Consider: Google Analytics
Keep GA only with full consent/transfer diligence; not a privacy substitute for Trackboxx.