> Rybbit is an open source, cookieless web analytics tool: how its default tracking works, self hosting options and when it can run without a consent banner. > > Canonical: https://www.flowconsent.com/en/services/analytics/rybbit Analytics # Rybbit Analytics Rybbit is an open source, privacy first web analytics platform positioned as a lightweight, cookieless alternative to Google Analytics, Plausible and Fathom. The default configuration runs without cookies, derives a daily rotating session ID from a salted hash of IP plus user agent and stores aggregated data only. Rybbit Cloud is hosted in Germany (Hetzner) and the server stack is fully open source for self hosting, which makes Rybbit one of the most compliance friendly analytics tools for European websites. [Block Rybbit until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Analytics](https://www.flowconsent.com/en/services/analytics) - Consent Analytics - Prior consent Not required - Documented cookies 1 - Third-party domains 3 - Servers Rybbit Cloud is hosted in the European Union (Hetzner Falkenstein, Germany). Rybbit also publishes the full server stack as open source so that customers can self host the back end on any infrastructure. Overview ## What does Rybbit do? ## **What Rybbit is** Rybbit is an open source, privacy first analytics platform aimed at indie hackers, SaaS teams and EU based publishers who want to drop Google Analytics. It ships as a lightweight JavaScript snippet, a small server stack written in Go and a modern dashboard. Rybbit Cloud runs from Hetzner Falkenstein in Germany; the same stack can be self hosted on any Linux server. ## **What data Rybbit collects** Rybbit collects page views, referrers, country derived from IP, device class, browser, screen breakpoint, time on page and custom events declared by the site owner. The session identifier is derived server side from a salted hash of IP plus user agent and the salt rotates every 24 hours, so the value cannot be linked across days. The full IP address is not stored. ## **GDPR and ePrivacy implications** Because Rybbit does not write to or read from the device, Article 5(3) of the ePrivacy Directive does not apply to the analytics path. The cookieless session ID, the IP anonymisation and the absence of third party sharing make the default deployment compatible with the CNIL exemption for audience measurement. Custom events that capture personal data still fall under the GDPR. ## **Consent and exemption** In the default configuration, Rybbit can be deployed without a cookie banner across the EU, including in France under the CNIL exemption and in Germany under the TTDSG essential cookie test. Site owners must still provide a transparent privacy notice that explains what is measured and how to object. Activating the optional first party cookie or capturing identifying custom events can move the deployment back into the consent regime. ## **Data transfers and hosting** Rybbit Cloud is hosted in Germany. No data leaves the European Union. Self hosters control the geography entirely. There are no Google or Meta dependencies, no IAB TCF participation and no advertising profiling. ## **Practical compliance steps** Sign the Rybbit DPA when using Rybbit Cloud, document the Legitimate Interest Assessment for cookieless audience measurement, mention Rybbit and the EU hosting in the privacy notice, avoid sending personal data through custom events without an opt in, and re evaluate if you decide to enable the optional first party cookie or to bridge Rybbit data with a CRM. Compliance ## Rybbit and the GDPR - Legal basis Legitimate interest (Art. 6(1)(f) GDPR) for the cookieless audience measurement, with a documented Legitimate Interest Assessment. The default Rybbit configuration meets the CNIL exemption criteria for analytics without consent because no persistent identifier is stored on the device, IP addresses are anonymised before storage and no data is shared with third parties. - Risk level low - Applicable regulations GDPR, ePrivacy Directive, French CNIL guidelines on audience measurement exemption, German TTDSG, Spanish LSSI, Italian Garante guidelines ### Impact assessment (DPIA) A DPIA is generally not required for Rybbit in its default cookieless configuration. It may become relevant if the deployment is enriched with custom event tracking that captures personal data fields, behavioural scoring or integration with external CRM systems. ### Sample text for your banner > This site uses Rybbit Analytics in cookieless mode to count visitors and understand which content works. No cookies are set, no personal data is shared with third parties, and analytics data is stored on EU servers. No consent is required for this configuration. Cookies and trackers ## What Rybbit sets and contacts - Tracking method Lightweight first party JavaScript snippet served from the Rybbit cloud (rybbit.io) or a self hosted instance. Cookieless by default, uses a daily rotating salted hash of IP + user agent to derive a session identifier without persistent storage on the device. Optional first party cookie can be enabled by self hosters. - Server location Rybbit Cloud is hosted in the European Union (Hetzner Falkenstein, Germany). Rybbit also publishes the full server stack as open source so that customers can self host the back end on any infrastructure. - Cookieless mode available Yes ### Cookies set (1) | Name | Type | Duration | Purpose | | ---------- | ---------- | --------- | -------------------------------------------------------------------------------------------------------------------------------- | | rybbit\_id | persistent | 12 months | Optional first party identifier set only when self hosters explicitly enable cookie based session tracking. Disabled by default. | ### Third-party domains contacted (3) - `rybbit.io` - `app.rybbit.io` - `cdn.rybbit.io` Questions ## Frequently asked questions about Rybbit Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Rybbit set? In its default configuration Rybbit sets no cookies at all. Sessions are derived server side from a daily rotating salted hash of IP and user agent. Self hosters can optionally enable a first party rybbit\_id cookie for higher accuracy on returning visitors, in which case Article 5(3) ePrivacy applies and consent becomes required. ### Do I need consent to use Rybbit? Not in the default cookieless configuration. Rybbit can be deployed without a cookie banner across the EU under the CNIL exemption for audience measurement and the TTDSG essential cookie test in Germany. A clear privacy notice is still required. ### What is the legal basis for Rybbit? Legitimate interest (Art. 6(1)(f) GDPR) for the cookieless audience measurement, supported by a documented Legitimate Interest Assessment. Consent (Art. 6(1)(a) GDPR) becomes the legal basis if the optional first party cookie is enabled or if custom events capture personally identifying data. ### Does Rybbit transfer data to the US? No. Rybbit Cloud is hosted in Germany and data does not leave the EU. Self hosters can choose any region. There are no Google or Meta dependencies and no IAB TCF participation. ### Do I need a DPIA for Rybbit? Generally no. Cookieless analytics on EU servers, with no advertising integration and no third party sharing, do not meet the DPIA threshold. A DPIA may become relevant if you bridge Rybbit with a CRM, capture sensitive personal data through custom events or operate at very large scale. ### How do I implement Rybbit compliantly? Use the cookieless default, sign the Rybbit Cloud DPA or document the self hosted environment, write a privacy notice that mentions Rybbit and the EU hosting, set a sensible data retention (12 months by default), and avoid sending personal data through custom events without an opt in. ### What are the alternatives to Rybbit? Other privacy first analytics tools include Plausible (EU hosted, cookieless), Fathom (EU hosted), Umami (self hosted), Matomo (self hosted, cookieless mode), Pirsch (Germany), Simple Analytics (Netherlands) and GoatCounter (open source). All can be deployed without a cookie banner under the CNIL exemption when configured correctly. ### How do I update the cookie policy for Rybbit? List Rybbit (publisher: Rybbit Analytics) with the purpose (audience measurement), the legal basis (legitimate interest in cookieless mode), the storage location (Germany for Rybbit Cloud, your own server otherwise), the cookies (none by default, optional rybbit\_id if enabled) and the retention period. Same category ## More services: Analytics [See the whole category](https://www.flowconsent.com/en/services/analytics) ### [Flurry Analytics](https://www.flowconsent.com/en/services/analytics/flurry-analytics) [Flurry Analytics is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Flurry Analytics supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Flurry Analytics enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/flurry-analytics) [Analytics](https://www.flowconsent.com/en/services/analytics/flurry-analytics) · ### [Callcap](https://www.flowconsent.com/en/services/analytics/call-cap) [Call Cap is a cloud-based communication platform that provides voice calling, VoIP, and telephony solutions for businesses. It supports call tracking, recording, IVR systems, and intelligent call routing. Call Cap integrates with CRM and helpdesk tools, enabling teams to manage voice interactions from a unified interface. With analytics and reporting, Call Cap helps businesses measure call performance and improve customer engagement.](https://www.flowconsent.com/en/services/analytics/call-cap) [Analytics](https://www.flowconsent.com/en/services/analytics/call-cap) · ### [Raaft](https://www.flowconsent.com/en/services/analytics/raaft) [Raaft is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Raaft supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Raaft enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/raaft) [Analytics](https://www.flowconsent.com/en/services/analytics/raaft) · ### [Sensors Data](https://www.flowconsent.com/en/services/analytics/sensors-data) [Sensors Data is a data management and processing platform that helps businesses collect, organize, and activate their data assets. It provides data integration, transformation, and governance tools for reliable pipelines. Sensors Data supports real-time and batch processing, quality monitoring, and compliance management. With connectors to major data sources and destinations, Sensors Data enables organizations to unify their data infrastructure and drive informed decision making.](https://www.flowconsent.com/en/services/analytics/sensors-data) [Analytics](https://www.flowconsent.com/en/services/analytics/sensors-data) · ### [Polar Analytics](https://www.flowconsent.com/en/services/analytics/polar-analytics) [Polar Analytics is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Polar Analytics offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Polar Analytics empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/polar-analytics) [Analytics](https://www.flowconsent.com/en/services/analytics/polar-analytics) · ### [Trovit](https://www.flowconsent.com/en/services/analytics/trovit) [Trovit is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Trovit supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Trovit enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/trovit) [Analytics](https://www.flowconsent.com/en/services/analytics/trovit) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)