Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Open source Ruby on Rails analytics gem for first party visit and event tracking, self hosted with data kept on the operator's own server.
Ahoy is an open source analytics gem for Ruby on Rails that records visits and events directly in the operator's own application. It is first party by design and keeps the data inside the operator's database rather than sending it to an external vendor.
Because Ahoy is self hosted, the operator controls where the data lives, how long it is kept and who can access it. This architecture gives strong control over personal data compared with hosted third party analytics.
Ahoy sets first party cookies named ahoy_visit and ahoy_visitor to group requests into visits and to recognise returning visitors. It records visit details such as landing page, referrer, and device and browser information, and any custom events the operator defines.
Ahoy can also store IP derived geolocation and a visitor identifier. These records are personal data under the GDPR, although Ahoy offers an anonymity set mode that avoids cookies and groups similar visitors instead.
When Ahoy uses cookies it reads and writes information on the visitor's device, so the ePrivacy Directive applies. Where the cookies are treated as non essential, prior consent is required before they are set.
Under the GDPR the operator is the sole controller because no external processor is involved. The operator must still provide a privacy notice, define a lawful basis and apply a retention period to visit and event data.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
If Ahoy is configured with cookies for analytics that are not strictly necessary, prior consent should be collected before the gem sets ahoy_visit and ahoy_visitor.
Ahoy can be configured without cookies using anonymity sets, which can reduce or remove the consent requirement in some jurisdictions where the measurement is strictly limited. Confirm the local interpretation before relying on an exemption.
Ahoy stores data on the operator's own infrastructure, so there is no transfer to a third party vendor. The transfer position depends entirely on where the operator hosts its servers.
If the operator hosts within the European Economic Area, no international transfer occurs. If hosting is outside the area, the operator must put an appropriate transfer mechanism in place.
Decide whether to run Ahoy with cookies or with anonymity sets, set a clear retention period for visits and events, and add the processing to your records.
If cookies are used, gate them behind consent and document ahoy_visit and ahoy_visitor in your cookie policy. Consider masking or truncating IP addresses and limiting the events you collect to what you genuinely need.
Websites using Ahoy must obtain user consent under GDPR regulations.
DPIA considerations
Ahoy keeps data on the operator's own server, which lowers risk, but a DPIA may still be warranted where event tracking is extensive or combined with account data. Assess retention of visit and visitor records, IP and geolocation storage, and whether anonymity sets are used instead of cookies, then document minimisation measures.
Sample consent text
We use Ahoy, a first party analytics tool hosted on our own servers, to understand how visitors use this site. With your consent, Ahoy sets first party cookies to count visits and events. You can accept or decline these analytics cookies at any time.
Third-party domains contacted
The operator's own website domainThe operator's own Rails application domainCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| ahoy_visit | First party | 4 hours | Identifies the current visit and groups events into a single session |
| ahoy_visitor | First party | 2 years | Recognises the returning visitor across visits for first party analytics |
| ahoy_track | First party | Session | Buffers events client side before they are sent to the operator's server |
Ahoy collects user analytics data — you legally need a consent banner. Try FlowConsent free.
By default Ahoy sets two first party cookies, ahoy_visit and ahoy_visitor. The visit cookie groups requests into a single visit and the visitor cookie recognises a returning visitor. Ahoy can also run without cookies using anonymity sets, in which case no analytics cookies are stored.
If Ahoy uses its cookies for non essential analytics, prior consent is generally required under the ePrivacy Directive. If you configure Ahoy with anonymity sets and avoid cookies, the consent requirement may be reduced or removed in some jurisdictions, subject to local interpretation.
Because data stays on your own server, many operators rely on legitimate interest for first party measurement, with a balancing test recorded. Where the cookies are treated as non essential, consent under the ePrivacy Directive is needed to set them. Document the basis you choose.
Ahoy itself does not transfer data to any vendor because it is self hosted. Whether data leaves the EU depends on where you host your application. If your servers are in the European Economic Area, no international transfer occurs.
Often not, because the risk is lower when data stays on your own server. A DPIA becomes advisable where event tracking is extensive, combined with account data, or stores precise geolocation. Assess scope and retention and document the outcome.
Choose between cookies and anonymity sets, set a retention period, and limit the events you record. If using cookies, gate them behind consent and list ahoy_visit and ahoy_visitor in your cookie policy. Consider masking IP addresses to minimise data.
Alternatives include other self hosted analytics tools and privacy focused platforms that offer cookieless measurement. For Rails teams Ahoy is attractive because the data stays in your own database, but lighter aggregate tools may suit simpler needs.
If you run Ahoy with cookies, list ahoy_visit and ahoy_visitor with their purpose and duration and state that they are first party analytics cookies. If you run anonymity sets, you can state that no analytics cookies are used. Keep the policy in step with your configuration.