ReplyBox

ReplyBox is a privacy focused website commenting system, built and hosted in the United Kingdom as a lightweight alternative to Disqus. It carries no ads, performs no behavioural tracking and never monetises visitor data, which makes it a low risk choice for site owners who want a community feature without the privacy baggage of larger platforms.

What ReplyBox is

ReplyBox provides threaded comments with markdown support and a deliberately small embed. Commenters can post and, if they wish, authenticate with Google or Twitter in two clicks. Spam is handled by Akismet and similar filters rather than by profiling visitors. The product is positioned explicitly against advertising and data monetisation, so its design avoids the trackers and third party cookies that commenting platforms have historically relied on.

Data and cookies

ReplyBox sets only minimal functional cookies. A session cookie keeps the comment widget working, and an authentication cookie is added only if a commenter chooses to log in. There are no advertising or analytics cookies, and the marketing site itself uses none. The personal data involved is limited to what is needed to display and moderate comments, such as a name, an optional email address and the comment text.

GDPR and ePrivacy implications

Under the GDPR and UK GDPR, displaying and moderating comments rests comfortably on legitimate interest, since visitors expect a comment they submit to appear and to be kept free of spam. The functional session cookie is strictly necessary under the ePrivacy Directive, so it does not need prior consent. You remain the data controller for the comments on your site, with ReplyBox acting as a processor under a data processing agreement.

Consent requirements

Because the comment cookie is functional and strictly necessary, you do not need a consent banner simply to show ReplyBox. Consent becomes relevant only when a visitor actively chooses to sign in with Google or Twitter, since that step shares limited data with a third party. In practice the visitor signals that choice by clicking the sign in button, which provides the legal basis of consent for that optional feature.

Data transfers

Two optional flows may involve a transfer outside the United Kingdom and the European Economic Area. The Akismet spam check sends comment metadata to a service operated in the United States, and the optional Google or Twitter sign in authenticates the commenter through a United States provider. These transfers are covered by Standard Contractual Clauses or the EU US Data Privacy Framework. ReplyBox itself is hosted in the United Kingdom, so the core comment storage stays local.

Practical compliance steps

List the functional ReplyBox cookies in your cookie policy, sign the data processing agreement and note ReplyBox as a processor in your records. Mention the Akismet spam check and the optional social sign in, along with the safeguards used for those United States transfers. If you enable Google or Twitter login, make clear that the third party only receives data when a visitor decides to use it, and keep a short note explaining your legitimate interest in moderating comments.