← Back to Directory
Logo: Trackboxx

Trackboxx

German cookie-free web analytics SaaS: day-rotating hash tracking, ecommerce and UTM dashboards, hosted analytics in Frankfurt with a published B2B DPA.

analyticsprivacygdprcookie-freeecommercesaas
Visit WebsiteAsk an EU migration specialistFeedback & corrections

Trackboxx is a German SaaS web analytics product for sites and shops that want visitor statistics without cookie-based trackers. Operators drop a lightweight script or CMS plugin and get dashboards for pageviews, sessions, channels, UTM campaigns, and conversion goals.

It exists as a German cookieless alternative to Google Analytics. Trackboxx states it uses no analytics cookies. Same-day session correlation uses hashes from IP, user agent, site ID, and a daily rotating key, kept at most 24 hours.

The concrete differentiator is that day-rotating hash model plus ecommerce and UTM dashboards, hosted in Frankfurt with a published B2B DPA.

Cookie-free trackingGermany-operatedFrankfurt analytics hostingE-commerce analyticsB2B DPA availableManaged SaaS

Shortlist Trackboxx when you want German-operated, cookie-free hosted analytics with ecommerce and agency-friendly public dashboards. Skip when you need self-host/open-source control or GA-class product analytics—consider Plausible (self-host option) or Matomo instead.

Key capabilities

No analytics cookies. Same-day visitor correlation uses hashes of IP, user agent, site ID, and a daily rotating signature (page hashes also include host/path). Hashes expire within 24 hours so multi-day visitor histories and IP recovery are not available by design.

Dashboards cover visits, pageviews, bounce rate, dwell time, devices/browsers, geo down to city, channel mix including AI traffic, outbound link clicks, live visitors on a short refresh interval, and period-over-period comparisons without a heavy analyst UI.

Shop metrics include products sold, cart abandonment, add-to-cart style signals, checkout funnel visibility, and revenue by channel and location—aimed at operators who need store KPIs without a full GA4 ecommerce implementation.

Campaign UTMs, conversion goals (including auto goals), optional Google Search Console keyword views, shareable public dashboards (URL or iframe), and PDF reports support marketers and agencies who need client-facing summaries.

Documented integrations include WordPress, Shopware, Shopify, JTL, and ePages. Help center also covers script install, excluding own IP/paths, ads tracking patterns, and importing historical Google Analytics data when migrating.

At a glance

HQ
Halberstadt / Grönwohld, Germany
Legal entity
Trackboxx / Christian Pust (imprint)
Product type
Managed web analytics SaaS
Open source
No
Self-host
No
Analytics hosting
First Colo, Frankfurt (via TK Enterprises Ltd)
Commercial model
Pageview packages; free tier + trial; Paddle checkout

Best fit when

  • German/EU SMEs and agencies replacing cookie-heavy GA for simpler privacy-oriented traffic stats
  • Online shops that need cart abandonment and revenue-by-channel without a full GA4 ecommerce stack
  • Teams that want public dashboards or PDF reports for clients and partners
  • Sites prioritizing fuller capture when consent banners and blockers suppress third-party analytics
  • Operators who accept managed SaaS and pageview-based packaging over self-hosting

Poor fit when

  • Organizations that must self-host or run open-source analytics under their own keys
  • Product/growth teams needing session replay, heatmaps, or advanced funnel/experiment suites
  • Enterprises requiring published ISO/SOC audit packs and extensive SSO/export documentation before shortlist
  • Buyers who need multi-year individual visitor identity graphs rather than same-day hash sessions

Consider instead when

  • When: You need cookieless EU analytics with an official self-host path

    Consider: Plausible Analytics (Cloud or Community Edition)

    Trade Trackboxx ecommerce/plugin depth for open-source deployability.

  • When: You want maximal privacy minimalism and a very small surface area

    Consider: Simple Analytics

    Simpler feature set; less ecommerce and shop-plugin emphasis than Trackboxx.

  • When: You need deep self-hosted analytics or on-prem control

    Consider: Matomo or Piwik PRO-class platforms

    Heavier ops and UI; stronger fit for full data residency under your infrastructure.

  • When: You depend on Google Ads identity graphs, Audiences, and free unlimited scale

    Consider: Google Analytics

    Keep GA only with full consent/transfer diligence; not a privacy substitute for Trackboxx.

Jurisdiction & ownership

Legal entity
Trackboxx / Christian Pust (sole trader imprint; Halberstadt seat, Grönwohld branch)
US parent / control
No known US parent
CLOUD Act exposure (indicative)
Medium
Hosting / residency
Visitor analytics: TK Enterprises Ltd infrastructure in First Colo Frankfurt. CDN: BunnyWay d.o.o. (Slovenia). Payments: Paddle.com Market Ltd (UK). Email/newsletters: Amazon SES (AWS; EU regions primary, possible US). Chat on marketing site: Userlike UG (Germany).

No known US parent. Analytics path is EU-hosted per help center and DPA annex; medium CLOUD Act exposure reflects Amazon SES (US-group) on email and residual US SaaS risk—not that analytics DB is claimed in the US. Indicative only; not legal advice.

  • Independent security / privacy auditNot found
  • ISO 27001Not found
  • SOC 2 / SOC 3Not found
  • GDPR / EU data protectionVendor claimed
  • +3

Considerations & known limitations

  • MediumConsent banner claim is vendor legal opinion

    Trackboxx argues legitimate interest and no opt-in for its cookie-free tracker alone, while noting some DPOs disagree. Other tags on the site can still force banners. Treat as diligence input, not a legal certificate.

  • MediumAmazon SES on email path

    Privacy policy discloses AWS SES for system/newsletter email with possible US transfers. Distinct from Frankfurt analytics storage, but raises residual US-group process exposure for account communications.

  • LowNo self-host edition

    Managed SaaS only. Policies that mandate customer-operated infrastructure need a different product.

  • MediumNo public ISO/SOC/independent audit

    Procurement teams that require cert packs will need questionnaires, DPA annex review, and possibly NDA materials beyond the public site.

  • LowSame-day hash limits multi-day user journeys

    By design you cannot rebuild long-lived individual visitor histories across days. Teams needing identity-resolution analytics will find this a hard product limit.

Open questions for due diligence

  • Is the DPA annex (subprocessors, TOMs) current relative to Amazon SES and any other processors used in production today?
  • What backup/DR locations and encryption practices apply beyond the First Colo Frankfurt statement?
  • Are enterprise SSO, data export APIs, or retention controls documented for larger buyers?
  • Has any independent penetration test or privacy audit been completed under NDA?
Request vendor DPA / enterprise contact
Ask an EU migration specialist
Visit WebsiteCompare similar toolsView alternativesFeedback & corrections

Frequently Asked Questions

Trackboxx processes the visitor IP (and related non-cookie signals) only to build a same-day hash with user agent, site ID, and a daily signature key. The hash is stored at most 24 hours; the signature rotates daily so you cannot rebuild a long-lived profile or reverse the hash to an IP. You get session-level counts for the day, not multi-week user journeys or identity graphs.

The vendor argues that no opt-in cookie banner is required for Trackboxx alone, citing legitimate interest and that IP is used only to pseudonymize for the hash window, and it publishes an opt-out path. It also notes some privacy specialists disagree and that this is not legal advice. If other cookies, tags, or processors remain on the site, consent obligations are unchanged—confirm with your DPO or counsel.

Help center material states analytics servers run via TK Enterprises Ltd in the First Colo data center in Frankfurt am Main. The public DPA annex lists TK Enterprises (hosting), Paddle (payments, UK), and BunnyWay (CDN, Slovenia). The site privacy policy separately names Amazon SES for email and Userlike for chat. Processing under the DPA is described as EU/EEA unless the controller agrees to third-country transfers under GDPR Chapter V.

Yes. Trackboxx offers a free AV/DPA; it is provided at order and published as a downloadable PDF (English courtesy version; German controls). The DPA covers processor duties, TOMs, subcontractor list, and deletion (account terminate keeps data about 60 days; full delete removes immediately subject to law).

Trackboxx is managed SaaS only—there is no official self-hosted edition. If policy requires software you run yourself, evaluate self-hostable alternatives such as Plausible Community Edition or Matomo rather than Trackboxx.

Trackboxx sells pageview-based packages with a limited free tier, a trial period without payment details, and paid plans that unlock features such as live visitors, ecommerce, UTM, reporting, and multi-site/user options depending on package. Checkout is via Paddle as merchant of record. Confirm current limits and feature matrices on the official registration/pricing page.