Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
ReplyBox is a privacy friendly website commenting system, a lightweight alternative to Disqus with no ads and no user tracking.
ReplyBox is a privacy focused website commenting system, built and hosted in the United Kingdom as a lightweight alternative to Disqus. It carries no ads, performs no behavioural tracking and never monetises visitor data, which makes it a low risk choice for site owners who want a community feature without the privacy baggage of larger platforms.
ReplyBox provides threaded comments with markdown support and a deliberately small embed. Commenters can post and, if they wish, authenticate with Google or Twitter in two clicks. Spam is handled by Akismet and similar filters rather than by profiling visitors. The product is positioned explicitly against advertising and data monetisation, so its design avoids the trackers and third party cookies that commenting platforms have historically relied on.
ReplyBox sets only minimal functional cookies. A session cookie keeps the comment widget working, and an authentication cookie is added only if a commenter chooses to log in. There are no advertising or analytics cookies, and the marketing site itself uses none. The personal data involved is limited to what is needed to display and moderate comments, such as a name, an optional email address and the comment text.
Under the GDPR and UK GDPR, displaying and moderating comments rests comfortably on legitimate interest, since visitors expect a comment they submit to appear and to be kept free of spam. The functional session cookie is strictly necessary under the ePrivacy Directive, so it does not need prior consent. You remain the data controller for the comments on your site, with ReplyBox acting as a processor under a data processing agreement.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Because the comment cookie is functional and strictly necessary, you do not need a consent banner simply to show ReplyBox. Consent becomes relevant only when a visitor actively chooses to sign in with Google or Twitter, since that step shares limited data with a third party. In practice the visitor signals that choice by clicking the sign in button, which provides the legal basis of consent for that optional feature.
Two optional flows may involve a transfer outside the United Kingdom and the European Economic Area. The Akismet spam check sends comment metadata to a service operated in the United States, and the optional Google or Twitter sign in authenticates the commenter through a United States provider. These transfers are covered by Standard Contractual Clauses or the EU US Data Privacy Framework. ReplyBox itself is hosted in the United Kingdom, so the core comment storage stays local.
List the functional ReplyBox cookies in your cookie policy, sign the data processing agreement and note ReplyBox as a processor in your records. Mention the Akismet spam check and the optional social sign in, along with the safeguards used for those United States transfers. If you enable Google or Twitter login, make clear that the third party only receives data when a visitor decides to use it, and keep a short note explaining your legitimate interest in moderating comments.
Websites using ReplyBox must obtain user consent under GDPR regulations.
DPIA considerations
ReplyBox is a low risk, privacy friendly comment widget that uses only a functional session cookie and does not track visitors. A full DPIA is rarely required, although a brief risk assessment is good practice if you enable optional Google or Twitter sign in. Document the legitimate interest in moderating comments and the limited data sent to Akismet for spam filtering.
Sample consent text
If you sign in with Google or Twitter to comment, your chosen provider receives limited data to authenticate you, which may involve a transfer to the United States.
Third-party domains contacted
getreplybox.comapp.getreplybox.comakismet.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| rb_session | functional | Session | Strictly necessary functional cookie that keeps the comment widget working during a visit. |
| rb_auth | functional | 30 days | Authentication cookie added only when a commenter chooses to log in, to keep them signed in. |
ReplyBox uses cookies for user preferences — inform visitors with a consent banner.
ReplyBox sets only minimal functional cookies. A session cookie keeps the comment widget working, and an authentication cookie is added only if a commenter chooses to log in. There are no advertising or analytics cookies.
No consent banner is needed simply to display ReplyBox, because the comment cookie is functional and strictly necessary. Consent is only required when a visitor actively chooses to sign in with Google or Twitter, which they signal by clicking the sign in button.
Displaying and moderating comments relies on legitimate interest under Art. 6(1)(f) GDPR, since visitors expect their comments to appear and stay free of spam. The optional Google or Twitter sign in relies on consent under Art. 6(1)(a) GDPR.
Two optional flows may transfer limited data to the United States. The Akismet spam check sends comment metadata, and the optional Google or Twitter sign in authenticates the commenter through a US provider. These transfers rely on Standard Contractual Clauses or the EU US Data Privacy Framework, while ReplyBox itself is hosted in the United Kingdom.
A full DPIA is rarely required, since ReplyBox is a low risk widget that uses only a functional cookie and does not track visitors. A brief risk assessment is good practice if you enable the optional Google or Twitter sign in.
List the functional ReplyBox cookies in your cookie policy, sign the data processing agreement and record ReplyBox as a processor. Note the Akismet spam check and the optional social sign in, and document your legitimate interest in moderating comments.
Common privacy friendly alternatives include Commento and Hyvor Talk, both of which limit tracking, as well as the larger Disqus, which is more focused on advertising and data monetisation. ReplyBox positions itself as a lightweight, privacy first option.
Yes, list the functional session and authentication cookies that ReplyBox uses, and note that the authentication cookie only appears when a commenter logs in. Mention the optional social sign in and the Akismet spam check so your policy is accurate.