Privacy-first analytics for websites & apps

In many cases, no. trackd.one sets no cookies, stores nothing on the device, avoids fingerprinting and only stores pseudonymised data — so it is designed for use based on legitimate interest (Art. 6(1)(f) GDPR). The script does not read device properties such as screen size or language; it only sends page address, title and referrer — language and device type are derived on the server from the request headers the browser sends anyway. Whether Section 25 TDDDG (German ePrivacy law) or similar rules require consent in a specific case is for you as the operator to assess, with legal advice if in doubt. Either way, mention trackd.one in your privacy policy — the DPA is concluded when you register.

We build a SHA-256 hash from the IP address, a secret key, a random salt that changes daily and the website ID. Same visitor on the same day = same hash; the next day produces a new hash and the old salt is deleted. The IP address itself is not stored, and cross-site tracking is not possible. In apps, the SDKs use a random session ID that is kept in memory only.

In a Cloudflare D1 database created with EU jurisdiction — data is stored in the EU. Requests are processed in Cloudflare's global network; Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, and standard contractual clauses apply in addition. Details are in the DPA.

The core script is about 2 KB gzipped. The optional Web Vitals module (about 1.5 KB) is loaded only after the page has loaded and can be turned off with data-vitals="false". Both load asynchronously, do not block rendering and have no external dependencies.

From 80% you see a notice in the dashboard. On paid plans collection continues beyond the limit — one-off spikes have no consequences. Only if you stay above the limit for two complete months in a row are the reports in the dashboard locked until you choose a suitable volume tier; collection continues even then. On the Free plan collection pauses at the limit until the end of the month. There are no automatic upgrades and no usage-based extra charges.

Your plan stays active until the end of the paid billing period; then your account moves to the Free plan (2 projects, 50,000 events/month, 6 months of statistics). The previous retention still applies for 30 days so you can export your data; after that, statistics older than 180 days are deleted.