rdyrct vs Trackboxx

Compare rdyrct and Trackboxx on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Google Analytics

rdyrct

Italy· Marketing Technology (MarTech) / Tag Management / Customer Data Platform

Needs review

Shortlist when you need branded short links, QR codes, and organization-scoped APIs with an explicit no-IP click schema under Italian control. Skip when you need a full website analytics suite or a vendor with published ISO/SOC audits and a registered company imprint. Consider Plausible Analytics for sitewide privacy analytics, or keep Google Analytics / Tag Manager when you need broad tagging rather than a redirect layer.

EU-operatedOpen sourceSelf-hostableNo IP in click analyticsAPI + MCP

View listing Visit Website

Trackboxx

Germany· Web Analytics

Needs review

Shortlist Trackboxx when you want German-operated, cookie-free hosted analytics with ecommerce and agency-friendly public dashboards. Skip when you need self-host/open-source control or GA-class product analytics—consider Plausible (self-host option) or Matomo instead.

Cookie-free trackingGermany-operatedFrankfurt analytics hostingE-commerce analyticsB2B DPA availableManaged SaaS

View listing Visit Website

Highlighted rows differ between the two products.

rdyrct vs Trackboxx: Snapshot
Feature	rdyrct	Trackboxx
Country of origin	Italy	Germany
Category	Marketing Technology (MarTech) / Tag Management / Customer Data Platform	Web Analytics
Open source	Yes	No
Self-hosted	Yes	No
Headquarters	Italy	Germany
Legal entity	Andrea Bruno (data controller; no public company registry ID found)	Trackboxx / Christian Pust (sole trader imprint; Halberstadt seat, Grönwohld branch)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
EU-hosted status	Partial	Not listed
Hosting / residency	Primary app and redirects on Cloudflare Workers/D1/KV/R2. Privacy policy also lists Resend (email), Polar (billing MoR), PostHog EU (optional product analytics), and Sentry (errors).	Visitor analytics: TK Enterprises Ltd infrastructure in First Colo Frankfurt. CDN: BunnyWay d.o.o. (Slovenia). Payments: Paddle.com Market Ltd (UK). Email/newsletters: Amazon SES (AWS; EU regions primary, possible US). Chat on marketing site: Userlike UG (Germany).
Summary	Italy-built URL shortener and QR platform for teams, with custom domains, UTM campaigns, and privacy-respecting click analytics.	German cookie-free web analytics SaaS: day-rotating hash tracking, ecommerce and UTM dashboards, hosted analytics in Frankfurt with a published B2B DPA.
Tags	analytics privacy SaaS URL shortener branded links QR codes UTM open-source Cloudflare Workers	analytics privacy SaaS gdpr cookie-free ecommerce

At a glance: rdyrct vs Trackboxx
At a glance	rdyrct	Trackboxx
HQ / controller	Andrea Bruno (Italy)	Not listed
Governing law	Italian law (terms)	Not listed
License	MIT	Not listed
Hosted stack	Cloudflare Workers, D1, KV, R2	Not listed
Commercial model	Free tier + subscription (Polar MoR)	Pageview packages; free tier + trial; Paddle checkout
HQ	Not listed	Halberstadt / Grönwohld, Germany
Legal entity	Not listed	Trackboxx / Christian Pust (imprint)
Product type	Not listed	Managed web analytics SaaS
Open source	Not listed	No
Self-host	Not listed	No
Analytics hosting	Not listed	First Colo, Frankfurt (via TK Enterprises Ltd)
Data residency regions	Cloudflare edge (global PoPs); product analytics via PostHog EU when consented	Not listed
Cookieless click analytics	Click schema excludes IP; necessary session cookie for accounts; PostHog cookie only with consent	Not listed

Key capabilities: rdyrct vs Trackboxx
Key capabilities	rdyrct	Trackboxx
EU-operated	Yes	Not listed
Open source	Yes	Not listed
Self-hostable	Yes	Not listed
No IP in click analytics	Yes	Not listed
API + MCP	Yes	Not listed
Cookie-free tracking	Not listed	Yes
Germany-operated	Not listed	Yes
Frankfurt analytics hosting	Not listed	Yes
E-commerce analytics	Not listed	Yes
B2B DPA available	Not listed	Yes
Managed SaaS	Not listed	Yes

rdyrct

Branded short links on custom domains
Point your domain at rdyrct with automatic TLS. Custom domains get chosen slugs; the shared rdyr.cc namespace always assigns random slugs. Hobby allows one custom domain and Pro allows five.
Privacy-bounded click analytics
Each click stores country, referrer, device, and timestamp only. The vendor states IP addresses and precise locations are never stored. Retention is plan-tiered (7 / 30 / 365 days on Free / Hobby / Pro).
UTM campaigns and quiet-link alerts
Built-in UTM builder plus import of existing UTM parameters. Campaigns, sources, and mediums rank by clicks; analytics compare periods, show activity heatmaps, and flag links with no clicks in 30 days or large week-over-week drops.
QR codes with optional logo
Generate PNG or SVG QR codes per link with colors and dot shapes. Logo overlays are a paid-plan capability with size limits. A browser-side QR generator page works without an account.
Organizations, API, and MCP
Owner, admin, and member roles with email invites that expire after 7 days. Organization-scoped REST API keys and a hosted MCP server with OAuth or API key auth are available on every plan.
MIT open source on Cloudflare
Self-host on Cloudflare Workers, D1, KV, and R2 from the public GitHub repository. Hosted-service terms do not apply to self-hosted installs; you become the platform admin and set your own limits.

Trackboxx

Cookie-free day-hash session tracking
No analytics cookies. Same-day visitor correlation uses hashes of IP, user agent, site ID, and a daily rotating signature (page hashes also include host/path). Hashes expire within 24 hours so multi-day visitor histories and IP recovery are not available by design.
Traffic, channel, and live visitor dashboards
Dashboards cover visits, pageviews, bounce rate, dwell time, devices/browsers, geo down to city, channel mix including AI traffic, outbound link clicks, live visitors on a short refresh interval, and period-over-period comparisons without a heavy analyst UI.
E-commerce funnels and revenue breakdowns
Shop metrics include products sold, cart abandonment, add-to-cart style signals, checkout funnel visibility, and revenue by channel and location—aimed at operators who need store KPIs without a full GA4 ecommerce implementation.
UTM, goals, GSC keywords, and public reports
Campaign UTMs, conversion goals (including auto goals), optional Google Search Console keyword views, shareable public dashboards (URL or iframe), and PDF reports support marketers and agencies who need client-facing summaries.
CMS and shop plugins plus GA import
Documented integrations include WordPress, Shopware, Shopify, JTL, and ePages. Help center also covers script install, excluding own IP/paths, ads tracking patterns, and importing historical Google Analytics data when migrating.

Assurance & compliance: rdyrct vs Trackboxx
Assurance & compliance	rdyrct	Trackboxx
Independent security / no-logs audit	Not found Vendor claims no IP storage for clicks; no independent audit PDF found on the public site.	Not found No public third-party audit PDF or cert registry entry found on primary pages.
ISO 27001	Not found	Not found No ISO 27001 claim found on imprint, help center, or DPA materials reviewed.
SOC 2 / SOC 3	Not found	Not found No SOC 2/3 report referenced on public trust materials reviewed.
GDPR / EU data protection	Vendor claimed Italian data controller; privacy policy describes lawful bases, rights, and Italian DPA complaint path. Confirm DPA for B2B.	Vendor claimed German controller imprint; cookie-free hash model; public DPA; processing described as EU/EEA. Vendor asserts DSGVO fitness—confirm with counsel for your site stack.
US CLOUD Act exposure (indicative)	Partial Italian operator / no known US parent, but hosted path uses Cloudflare, Resend, Polar MoR, and Sentry (US-group SaaS/cloud). Not legal advice.	Partial EU sole-trader operator, no known US parent; analytics hosting claimed in Frankfurt. Partial/medium because privacy policy names Amazon SES (AWS) for email with possible US transfers; payments via UK Paddle. Not legal advice.
Data processing agreement (B2B)	Not found No public DPA download or in-product DPA link found during research.	Vendor claimed Free AV/DPA offered at order and as PDF; annex lists hosting, Paddle, BunnyWay.
EU AI Act	Not applicable	Not applicable Web analytics SaaS; not an AI system product for AI Act high-risk classification purposes.

Considerations & known limitations: rdyrct vs Trackboxx
Considerations & known limitations	rdyrct	Trackboxx
US-group hosting and SaaS subprocessors	Medium Core service runs on Cloudflare; email, billing MoR, and error monitoring also use US-group providers. Teams with a hard ban on US cloud need self-host controls plus their own vendor choices, or a different product.	Not listed
Individual data controller without public company registry ID	Medium Procurement teams that require a registered company imprint and VAT ID will need offline confirmation; the public site names Andrea Bruno as controller under Italian law only.	Not listed
No public independent audit or ISO/SOC	Medium No-IP click claims are vendor statements. Security questionnaires that mandate third-party audits will stall until materials are provided under NDA or published.	Medium Procurement teams that require cert packs will need questionnaires, DPA annex review, and possibly NDA materials beyond the public site.
Young public product	Low Domain and public GitHub repository date from July 2026. Expect faster change and thinner operational history than long-running shorteners.	Not listed
Consent banner claim is vendor legal opinion	Not listed	Medium Trackboxx argues legitimate interest and no opt-in for its cookie-free tracker alone, while noting some DPOs disagree. Other tags on the site can still force banners. Treat as diligence input, not a legal certificate.
Amazon SES on email path	Not listed	Medium Privacy policy discloses AWS SES for system/newsletter email with possible US transfers. Distinct from Frankfurt analytics storage, but raises residual US-group process exposure for account communications.
No self-host edition	Not listed	Low Managed SaaS only. Policies that mandate customer-operated infrastructure need a different product.
Same-day hash limits multi-day user journeys	Not listed	Low By design you cannot rebuild long-lived individual visitor histories across days. Teams needing identity-resolution analytics will find this a hard product limit.

Fit

rdyrct

Best fit when

Teams that need branded short links and QR codes under one organization with owner/admin/member roles
Buyers who require click analytics without storing IP addresses or precise locations
Engineers who want REST API keys and a hosted MCP server for agent-driven link workflows
Operators willing to run on Cloudflare Workers, including self-host on their own Cloudflare account
Italian or EU-governed procurement where the named Italian data controller and Italian governing law matter

Poor fit when

Organizations that need a full sitewide web analytics product rather than link and QR redirect analytics
Buyers that require a published ISO 27001 or SOC 2 report before shortlisting
Teams that refuse US-group subprocessors entirely (hosted path uses Cloudflare, Resend, Polar MoR, and Sentry)
Enterprises that need a registered company imprint with public VAT/registry ID on the vendor site

Consider instead when

When: You need privacy-friendly website analytics across pages, not just short-link redirects
Consider: Plausible Analytics or Trackboxx
Those products measure site traffic; rdyrct measures links and QR scans you create.
When: You need a mature MarTech CDP / tag management suite with enterprise contracts
Consider: Commanders Act
rdyrct is a focused shortener and QR tool, not a customer data platform.
When: You already standardize on Google tagging for campaigns and only need redirect vanity domains later
Consider: Google Analytics or Google Tag Manager
Keep them for sitewide tagging; evaluate rdyrct only for the short-link and QR control plane.

Trackboxx

Best fit when

German/EU SMEs and agencies replacing cookie-heavy GA for simpler privacy-oriented traffic stats
Online shops that need cart abandonment and revenue-by-channel without a full GA4 ecommerce stack
Teams that want public dashboards or PDF reports for clients and partners
Sites prioritizing fuller capture when consent banners and blockers suppress third-party analytics
Operators who accept managed SaaS and pageview-based packaging over self-hosting

Poor fit when

Organizations that must self-host or run open-source analytics under their own keys
Product/growth teams needing session replay, heatmaps, or advanced funnel/experiment suites
Enterprises requiring published ISO/SOC audit packs and extensive SSO/export documentation before shortlist
Buyers who need multi-year individual visitor identity graphs rather than same-day hash sessions

Consider instead when

When: You need cookieless EU analytics with an official self-host path
Consider: Plausible Analytics (Cloud or Community Edition)
Trade Trackboxx ecommerce/plugin depth for open-source deployability.
When: You want maximal privacy minimalism and a very small surface area
Consider: Simple Analytics
Simpler feature set; less ecommerce and shop-plugin emphasis than Trackboxx.
When: You need deep self-hosted analytics or on-prem control
Consider: Matomo or Piwik PRO-class platforms
Heavier ops and UI; stronger fit for full data residency under your infrastructure.
When: You depend on Google Ads identity graphs, Audiences, and free unlimited scale
Consider: Google Analytics
Keep GA only with full consent/transfer diligence; not a privacy substitute for Trackboxx.

Open questions for due diligence

rdyrct

Will the vendor sign a B2B DPA and provide a current subprocessor list with regions?
Is there a registered Italian sole proprietorship or company VAT ID for contracting?
Are any independent security or no-logs audits available under NDA?
For self-host: which Cloudflare regions or account controls are recommended for residency-sensitive deployments?

Trackboxx

Is the DPA annex (subprocessors, TOMs) current relative to Amazon SES and any other processors used in production today?
What backup/DR locations and encryption practices apply beyond the First Colo Frankfurt statement?
Are enterprise SSO, data export APIs, or retention controls documented for larger buyers?
Has any independent penetration test or privacy audit been completed under NDA?