FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Other

Gitea

AnalyticsOfficial website

Lightweight, self hosted Git service written in Go that sets strictly necessary session and CSRF cookies when an end user signs into the web interface.

Block Gitea until consentScan my site
Overview

What does Gitea do?

What is Gitea

Gitea is an open source, self hosted Git service written in Go. Organisations install it on their own infrastructure to host repositories, manage issues, run CI pipelines and review code internally. Because every Gitea instance is operated by the deploying organisation, the controller and the data location are entirely defined by that operator and not by an external vendor.

Cookies and data collected

When a user authenticates against the Gitea web interface, the server sets cookies named i_like_gitea (the session cookie), _csrf (CSRF protection token), lang (language preference) and gitea_incredible (remember me token when enabled). Gitea also stores commit metadata, repository activity, issue comments and access logs. These are processed under the responsibility of the operating organisation.

GDPR and ePrivacy implications

The Gitea session, CSRF and language cookies are strictly necessary to deliver the service requested by the user, so they fall under the ePrivacy exemption of Article 5(3) and do not require prior consent. The remember me cookie is functional and may also be exempt as long as it is enabled at the explicit request of the authenticated user. Standard user account data is processed on the basis of contract performance or legitimate interest, depending on context.

Data transfers

Because Gitea is self hosted, there is no automatic transfer to a third country. The data location is fully determined by the operator. If you host the instance in the EU on your own hardware or with an EU based cloud provider, all processing stays within the EEA. If you choose a non EU hosting provider, you must apply the usual Chapter V safeguards.

How to implement compliance

Restrict the Gitea web interface to authenticated users, enforce HTTPS and Secure HttpOnly cookies, configure short session timeouts and limit access logs to the retention period your security policy requires. Document Gitea in your record of processing activities, mention it in the employee or contributor privacy notice and provide an internal procedure for data subject requests.

Compliance

Gitea and the GDPR

Legal basis
Consent (GDPR Art. 6(1)(a)) and ePrivacy Directive Art. 5(3) for cookie storage
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive, TTDSG, LIL, LOPDGDD

Impact assessment (DPIA)

A full DPIA is rarely required for an internal Gitea instance because cookies are strictly necessary and data stays under the operators control. A DPIA may still be needed when Gitea is exposed publicly, processes special category data or is hosted by a non EU cloud provider.

Sample text for your banner

This site uses Gitea, a self hosted Git service. It sets strictly necessary session and CSRF cookies when you sign in to your account. No consent is required for these cookies, but you can review our privacy notice for more details.
Cookies and trackers

What Gitea sets and contacts

Tracking method
Self hosted Git platform written in Go that sets first party authentication, CSRF and preference cookies on the visitor browser when the web interface is used
Server location
Operator dependent (self hosted; data location is the server chosen by the operator)

Cookies set (4)

NameTypeDurationPurpose
i_like_giteanecessarySessionPrimary session cookie that authenticates the user against the Gitea web interface and links subsequent requests to the active session.
_csrfnecessarySessionCross site request forgery protection token used by Gitea to validate that form submissions originate from the legitimate authenticated session.
langpreferences1 yearStores the language preference selected by the user so the Gitea interface is displayed in the same language on subsequent visits.
gitea_incrediblefunctional30 daysRemember me token set only when the user activates the Stay signed in option; it keeps the session valid across browser restarts.

Third-party domains contacted (3)

  • gitea.com
  • gitea.io
  • dl.gitea.com
Questions

Frequently asked questions about Gitea

Can't find your question? Write to us, we answer fast.

What cookies does Gitea set?

Gitea sets i_like_gitea for the active session, _csrf for CSRF protection, lang for the language preference and gitea_incredible for the remember me option when the user enables it. All are first party cookies on the domain of the Gitea instance.

Is user consent required before loading Gitea?

No prior consent is required for the strictly necessary cookies because they are essential to deliver an authenticated session. The remember me cookie is functional and is only set after the user actively requests it, so no consent banner is needed for a typical Gitea deployment.

What is the legal basis for processing personal data via Gitea?

User account data is usually processed on the basis of contract performance under Article 6(1)(b) of the GDPR for employees and contributors, or legitimate interest under Article 6(1)(f) for internal security and audit logs. Cookies rely on the ePrivacy exemption.

Does Gitea transfer data outside the EU, especially to the US?

Gitea itself does not transfer data anywhere. If you host the instance in the EU you stay inside the EEA. Transfers only happen when you choose a non EU hosting provider or use external integrations such as webhooks pointing to third country services.

Is a DPIA required when using Gitea?

A DPIA is generally not required for an internal Gitea instance because cookies are strictly necessary and the volume of personal data is limited. A DPIA may be triggered when Gitea hosts repositories that contain personal data on a large scale, sensitive categories or is exposed publicly.

How do I correctly implement Gitea in a GDPR compliant way?

Host the instance on EU infrastructure, enforce HTTPS, set Secure and HttpOnly flags on every cookie, configure SSO with strong authentication, restrict logs to a defined retention period and document the processing in your record of processing activities.

Are there privacy friendly alternatives to Gitea?

Other self hosted Git platforms such as Forgejo, GitLab Community Edition or cgit also keep data on infrastructure you control. They share the same favourable privacy profile because the operator decides where data is stored and which cookies are activated.

How should I update my cookie policy to mention Gitea?

List the four Gitea cookies, mark them as strictly necessary or functional, indicate the retention period configured on your instance and explain that they are required to deliver the authenticated Git web interface. Add a link to the operator privacy notice.

Same category

More services: Other

See the whole category

Anima

Anima is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Anima offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Anima empowers organizations to optimize strategy and maximize return on investment.

Analytics

Webscribble

Webscribble is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Webscribble supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Webscribble ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Carta

Carta is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Carta supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Carta ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

ServiceM8

ServiceM8 is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. ServiceM8 provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, ServiceM8 helps deliver the right message to the right audience at the right time.

Marketing

Ziber

Ziber is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Ziber supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Ziber ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Other

Employment Hero

Employment Hero is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Employment Hero supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Employment Hero ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site