Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Performance and observability service that captures browser errors, performance metrics and user session metadata through a JavaScript SDK and a server side ingestion API.
Harborbyte is a performance and observability service used by web teams to track frontend errors, page performance metrics (TTFB, LCP, FID) and user session metadata. A small JavaScript SDK is dropped on the page; it batches events and ships them to the Harborbyte ingestion API for analysis.
The SDK writes a first party session cookie (hb_session) and a longer lived visitor cookie (hb_visitor). Events sent to the ingestion endpoint contain the page URL, user agent, error stacks, performance timings, IP address and an optional user identifier set by the operator.
Both cookies and the SDK request to the Harborbyte API trigger Article 5(3) ePrivacy because they read or write information on the visitor device. Consent is therefore required before the SDK loads. The IP address and any session identifiers shared with the API constitute personal data under Article 4(1) GDPR.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Harborbyte hosts ingestion in US AWS regions. EU operators must sign Standard Contractual Clauses with Harborbyte, complete a Transfer Impact Assessment and document the residency in their RoPA. Confirm whether an EU residency option is available before signing.
Gate the SDK behind your CMP, configure the SDK to scrub form inputs and URL query strings, set a short retention for session replays, sign the DPA and SCCs, run a DPIA when stack traces can incidentally contain personal data, and surface Harborbyte in your privacy notice.
Websites using Harborbyte must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is appropriate when Harborbyte session metadata can be linked to identified users (logged in customers) or when stack traces can incidentally contain personal data from form inputs and URL parameters.
Sample consent text
We use Harborbyte to monitor performance and detect errors. With your consent, the Harborbyte SDK stores diagnostic information on your device and sends it to servers in the United States.
Third-party domains contacted
harborbyte.comcdn.harborbyte.comingest.harborbyte.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| hb_session | first_party | Session | Session identifier used to group performance and error events from the same browsing session. |
| hb_visitor | first_party | 1 year | Persistent visitor identifier used to deduplicate users across sessions and to count returning visitors. |
| hb_exp | first_party | 90 days | Stores assignment to A/B experiment variants when the operator activates the experimentation feature. |
Harborbyte uses cookies for user preferences — inform visitors with a consent banner.
The Harborbyte SDK writes hb_session (session) and hb_visitor (long lived). Optional cookies may be set if user identification or experiment bucketing is enabled.
Yes. The cookies and the data sent to the ingestion API trigger Article 5(3) ePrivacy. Consent must be obtained before the SDK loads.
Consent (Art. 6(1)(a) GDPR) for cookies and behavioural events. Legitimate interest may apply for purely operational error reporting that does not involve user behaviour.
Yes. The default ingestion runs on US AWS. Sign SCCs, complete a TIA and document the transfer in your RoPA.
Recommended when stack traces, query strings or session replays can incidentally contain personal data, and when session metadata is linked to identified users.
Gate the SDK behind your CMP, scrub form inputs, mask URL query strings, set short retention for replays, sign the DPA and SCCs, and review the integration yearly.
EU friendly alternatives include Sentry (with EU residency), GlitchTip (self hosted), Datadog (EU site), Honeycomb and self hosted Grafana Faro.
List hb_session and hb_visitor with their purpose, retention and processor. Mention the US transfer, the SCCs and the right to withdraw consent.