Tinylytics vs Trackboxx

Compare Tinylytics and Trackboxx on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Fathom Analytics, Google Analytics

Tinylytics

United Kingdom· Web Analytics

Needs review

Shortlist Tinylytics when you want cookieless page analytics plus bundled uptime/SSL/content checks for a handful of small sites, with primary data on Hetzner in Germany and founder support. Skip when you need self-host/open source, formal ISO/SOC packs, or enterprise multi-tenant governance—consider Plausible Analytics or Simple Analytics instead.

Cookieless analyticsPrimary host: Hetzner DEUptime + SSL monitoringBroken-link crawlsSaaS only (no self-host)Solo-founder UK

View listing Visit Website

Trackboxx

Germany· Web Analytics

Needs review

Shortlist Trackboxx when you want German-operated, cookie-free hosted analytics with ecommerce and agency-friendly public dashboards. Skip when you need self-host/open-source control or GA-class product analytics—consider Plausible (self-host option) or Matomo instead.

Cookie-free trackingGermany-operatedFrankfurt analytics hostingE-commerce analyticsB2B DPA availableManaged SaaS

View listing Visit Website

Highlighted rows differ between the two products.

Tinylytics vs Trackboxx: Snapshot
Feature	Tinylytics	Trackboxx
Country of origin	United Kingdom	Germany
Category	Web Analytics	Web Analytics
Open source	No	No
Self-hosted	No	No
Headquarters	United Kingdom	Germany
Legal entity	Vincent Ritter Consulting (service brand; terms state not separately incorporated yet)	Trackboxx / Christian Pust (sole trader imprint; Halberstadt seat, Grönwohld branch)
Governing law	Not clearly stated as a single governing-law clause on the public terms page; confirm contractually	Not listed
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
Hosting / residency	Primary analytics storage: Hetzner Falkenstein (Germany). CDN/security: Cloudflare. Error monitoring: Sentry.io. Payments: Paddle and Lemon Squeezy (Stripe company). Optional: IPinfo geo fallback for API hits; opt-in AI Insights via xAI and Google Gemini. No public backup-provider detail beyond that stack.	Visitor analytics: TK Enterprises Ltd infrastructure in First Colo Frankfurt. CDN: BunnyWay d.o.o. (Slovenia). Payments: Paddle.com Market Ltd (UK). Email/newsletters: Amazon SES (AWS; EU regions primary, possible US). Chat on marketing site: Userlike UG (Germany).
Summary	Privacy-first cookieless web analytics for small sites, with bundled uptime/SSL checks, content monitoring, events, and founder support—hosted primarily on Hetzner in Germany.	German cookie-free web analytics SaaS: day-rotating hash tracking, ecommerce and UTM dashboards, hosted analytics in Frankfurt with a published B2B DPA.
Tags	analytics privacy cookie-free gdpr uptime-monitoring indie api	analytics privacy cookie-free gdpr ecommerce saas

At a glance: Tinylytics vs Trackboxx
At a glance	Tinylytics	Trackboxx
HQ / operator	Vincent Ritter Consulting, United Kingdom	Not listed
Launched	12 June 2023 (live counters on homepage)	Not listed
Primary hosting	Hetzner, Falkenstein, Germany	Not listed
Deployment	Managed SaaS only (not open source, not self-hosted)	Not listed
Commercial model	Paid site-count plans; short trial; no permanent free tier	Pageview packages; free tier + trial; Paddle checkout
Differentiators	Analytics + uptime/SSL/content monitoring + widgets	Not listed
HQ	Not listed	Halberstadt / Grönwohld, Germany
Legal entity	Not listed	Trackboxx / Christian Pust (imprint)
Product type	Not listed	Managed web analytics SaaS
Open source	Not listed	No
Self-host	Not listed	No
Analytics hosting	Not listed	First Colo, Frankfurt (via TK Enterprises Ltd)

Key capabilities: Tinylytics vs Trackboxx
Key capabilities	Tinylytics	Trackboxx
Cookieless analytics	Yes	Not listed
Primary host: Hetzner DE	Yes	Not listed
Uptime + SSL monitoring	Yes	Not listed
Broken-link crawls	Yes	Not listed
SaaS only (no self-host)	Yes	Yes
Solo-founder UK	Yes	Not listed
Cookie-free tracking	Not listed	Yes
Germany-operated	Not listed	Yes
Frankfurt analytics hosting	Not listed	Yes
E-commerce analytics	Not listed	Yes
B2B DPA available	Not listed	Yes

Tinylytics

Cookie-free unique hits with rotating salts
Page views and unique hits without tracking cookies or fingerprinting. Uniques combine truncated request signals with a 12-hour rotating salt and one-way hash, reset daily at midnight UTC; visitor IPs are not stored in hits. Suited to indie sites that want trendable uniques without consent banners for analytics cookies.
Thunder Clap uptime, SSL, and domain alerts
In-house multi-region health checks (default every 10 minutes) confirm downtime before emailing, plus SSL expiry notices and domain monitoring. Ultra can shorten intervals. Replaces a separate uptime tool for small fleets—but false downs can occur if WAFs block the Tinylytics monitor user-agent.
Daily content crawl for broken links and mixed content
Subscribed sites can crawl up to 50 pages (two levels deep) on a daily cadence, flagging broken links and mixed HTTP assets on HTTPS pages, with ignore lists and re-check. Ultra adds optional AI spell-check on visible copy—keep it off if AI subprocessors are out of policy.
Attribute-based event tracking (beta)
Enable events on the embed script and mark elements with data-tinylytics-event using category.action names (optional values for downloads). No GTM required; beacon mode helps navigations. Still beta—expect API/schema changes and incomplete capture under aggressive blockers.
Public stats, kudos, hit counters, API, and webhooks
Share passcode-protected public stats, embed hit counters and kudos buttons, export CSV, call the documented API, and push signed webhooks for visits, events, and monitoring. Built for transparent blogs and light automation rather than enterprise BI warehouses.

Trackboxx

Cookie-free day-hash session tracking
No analytics cookies. Same-day visitor correlation uses hashes of IP, user agent, site ID, and a daily rotating signature (page hashes also include host/path). Hashes expire within 24 hours so multi-day visitor histories and IP recovery are not available by design.
Traffic, channel, and live visitor dashboards
Dashboards cover visits, pageviews, bounce rate, dwell time, devices/browsers, geo down to city, channel mix including AI traffic, outbound link clicks, live visitors on a short refresh interval, and period-over-period comparisons without a heavy analyst UI.
E-commerce funnels and revenue breakdowns
Shop metrics include products sold, cart abandonment, add-to-cart style signals, checkout funnel visibility, and revenue by channel and location—aimed at operators who need store KPIs without a full GA4 ecommerce implementation.
UTM, goals, GSC keywords, and public reports
Campaign UTMs, conversion goals (including auto goals), optional Google Search Console keyword views, shareable public dashboards (URL or iframe), and PDF reports support marketers and agencies who need client-facing summaries.
CMS and shop plugins plus GA import
Documented integrations include WordPress, Shopware, Shopify, JTL, and ePages. Help center also covers script install, excluding own IP/paths, ads tracking patterns, and importing historical Google Analytics data when migrating.

Assurance & compliance: Tinylytics vs Trackboxx
Assurance & compliance	Tinylytics	Trackboxx
Independent security / no-logs audit	Not found No public third-party security or no-logs audit report found on official docs.	Not found No public third-party audit PDF or cert registry entry found on primary pages.
ISO 27001	Not found No ISO 27001 claim found on privacy, compliance, or hosting pages.	Not found No ISO 27001 claim found on imprint, help center, or DPA materials reviewed.
SOC 2 / SOC 3	Not found No SOC 2/3 report or claim found on public site.	Not found No SOC 2/3 report referenced on public trust materials reviewed.
GDPR / EU data protection	Vendor claimed Vendor documents GDPR-oriented design (cookieless, data minimisation, EU primary host, deletion). Not independent certification.	Vendor claimed German controller imprint; cookie-free hash model; public DPA; processing described as EU/EEA. Vendor asserts DSGVO fitness—confirm with counsel for your site stack.
US CLOUD Act exposure (indicative)	Partial UK operator, no known US parent, primary host Hetzner DE; partial exposure via Cloudflare, Sentry, Lemon Squeezy/Paddle, optional IPinfo and opt-in US AI APIs. Not legal advice.	Partial EU sole-trader operator, no known US parent; analytics hosting claimed in Frankfurt. Partial/medium because privacy policy names Amazon SES (AWS) for email with possible US transfers; payments via UK Paddle. Not legal advice.
Data processing agreement (B2B)	Not found No public DPA/downloadable processor agreement found; ask the vendor before B2B rollout.	Vendor claimed Free AV/DPA offered at order and as PDF; annex lists hosting, Paddle, BunnyWay.
EU AI Act	Not applicable Core product is analytics/monitoring; optional AI insights are secondary and opt-in.	Not applicable Web analytics SaaS; not an AI system product for AI Act high-risk classification purposes.

Considerations & known limitations: Tinylytics vs Trackboxx
Considerations & known limitations	Tinylytics	Trackboxx
US-group subprocessors on the data path	Medium Cloudflare, Sentry, payment processors (incl. Lemon Squeezy/Stripe group), optional IPinfo and opt-in xAI/Gemini mean the stack is not EU-only end-to-end despite Hetzner primary storage.	Not listed
Solo-founder operational concentration	Medium Service is provided by Vincent Ritter Consulting / a solo developer. Support is personal and fast for indies, but bus-factor and formal SLA expectations differ from larger vendors.	Not listed
No public ISO/SOC/audit or DPA pack	Medium Enterprise security questionnaires will hit gaps until the vendor supplies audits and a B2B DPA under NDA or email.	Not listed
Scale and feature boundaries	Low Content crawls are depth/page limited; event tracking is beta; fair-usage applies to extreme hit volumes; no self-host escape hatch.	Not listed
Optional AI shares aggregated analytics	Low AI Insights and related AI spell-check are opt-in and send aggregated (not visitor PII per vendor) data to third-party AI providers—leave disabled under strict AI policies.	Not listed
Consent banner claim is vendor legal opinion	Not listed	Medium Trackboxx argues legitimate interest and no opt-in for its cookie-free tracker alone, while noting some DPOs disagree. Other tags on the site can still force banners. Treat as diligence input, not a legal certificate.
Amazon SES on email path	Not listed	Medium Privacy policy discloses AWS SES for system/newsletter email with possible US transfers. Distinct from Frankfurt analytics storage, but raises residual US-group process exposure for account communications.
No self-host edition	Not listed	Low Managed SaaS only. Policies that mandate customer-operated infrastructure need a different product.
No public ISO/SOC/independent audit	Not listed	Medium Procurement teams that require cert packs will need questionnaires, DPA annex review, and possibly NDA materials beyond the public site.
Same-day hash limits multi-day user journeys	Not listed	Low By design you cannot rebuild long-lived individual visitor histories across days. Teams needing identity-resolution analytics will find this a hard product limit.

Fit

Tinylytics

Best fit when

Indie blogs, portfolios, and side projects that want simple cookieless stats without Google Analytics
Small sites that also want uptime, SSL expiry, and broken-link checks in the same tool
Operators who prefer founder-answered support and lightweight embeds over enterprise marketing stacks
Teams OK with managed EU primary hosting and willing to review named US-group subprocessors (CDN, payments, optional AI)
Agencies managing a modest number of client sites with public stats or kudos-style engagement widgets

Poor fit when

Orgs that require self-hosted collectors or open-source audit of the full analytics stack
Procurement needing published ISO 27001, SOC 2, independent audits, or a downloadable DPA out of the box
Very high-traffic properties needing contractual capacity/SLA commitments beyond fair-usage conversation
Policies that ban Cloudflare/Sentry/US payment or optional US AI APIs on any data path
Teams that need session replay, heatmaps, or deep advertising attribution (Clarity/GA territory)

Consider instead when

When: You need open-source and optional self-hosting of the analytics stack
Consider: Plausible Analytics
Estonian product with Cloud plus Community Edition self-host; less bundling of uptime/content monitors.
When: You want European cookieless analytics with a simpler analytics-only scope
Consider: Simple Analytics
Strong privacy positioning; compare feature depth and monitoring separately.
When: You need free-at-scale marketing analytics, ads integrations, or attribution depth
Consider: Google Analytics (incumbent) — or stay on a privacy tool if GA is disallowed
Different privacy and sovereignty profile entirely.
When: You need session replay or heatmaps and accept that privacy model
Consider: Microsoft Clarity or specialised replay tools
Tinylytics deliberately avoids fingerprinting-style session products.

Trackboxx

Best fit when

German/EU SMEs and agencies replacing cookie-heavy GA for simpler privacy-oriented traffic stats
Online shops that need cart abandonment and revenue-by-channel without a full GA4 ecommerce stack
Teams that want public dashboards or PDF reports for clients and partners
Sites prioritizing fuller capture when consent banners and blockers suppress third-party analytics
Operators who accept managed SaaS and pageview-based packaging over self-hosting

Poor fit when

Organizations that must self-host or run open-source analytics under their own keys
Product/growth teams needing session replay, heatmaps, or advanced funnel/experiment suites
Enterprises requiring published ISO/SOC audit packs and extensive SSO/export documentation before shortlist
Buyers who need multi-year individual visitor identity graphs rather than same-day hash sessions

Consider instead when

When: You need cookieless EU analytics with an official self-host path
Consider: Plausible Analytics (Cloud or Community Edition)
Trade Trackboxx ecommerce/plugin depth for open-source deployability.
When: You want maximal privacy minimalism and a very small surface area
Consider: Simple Analytics
Simpler feature set; less ecommerce and shop-plugin emphasis than Trackboxx.
When: You need deep self-hosted analytics or on-prem control
Consider: Matomo or Piwik PRO-class platforms
Heavier ops and UI; stronger fit for full data residency under your infrastructure.
When: You depend on Google Ads identity graphs, Audiences, and free unlimited scale
Consider: Google Analytics
Keep GA only with full consent/transfer diligence; not a privacy substitute for Trackboxx.

Open questions for due diligence

Tinylytics

Will Vincent Ritter Consulting sign a GDPR Article 28 DPA and provide a current subprocessor list under contract?
Are backups/DR and email delivery fully covered by the named providers, or are there additional hosts?
Is there any roadmap for independent security review, SOC 2, or ISO 27001?
What contractual terms apply for accounts consistently above the fair-usage hit threshold?
For AI Insights: exact retention, regions, and processor terms at xAI and Google for the paid API plans used?

Trackboxx

Is the DPA annex (subprocessors, TOMs) current relative to Amazon SES and any other processors used in production today?
What backup/DR locations and encryption practices apply beyond the First Colo Frankfurt statement?
Are enterprise SSO, data export APIs, or retention controls documented for larger buyers?
Has any independent penetration test or privacy audit been completed under NDA?