Privacy Policy

Last updated: May 7, 2025

Overview

Rybbit is an open-source, privacy-friendly web analytics alternative to Google Analytics. This privacy policy explains our approach to data collection and how we prioritize user privacy while still providing website owners with valuable insights.

Data We Collect

Rybbit collects the following anonymous data about website visits:

• Page data: URLs visited, page titles, referrers, and query parameters
• Visit information: Session duration, entry and exit pages
• Device information: Browser type and version, operating system, screen resolution, device type
• Location data: Country and region (derived from IP address, which is not stored)
• Marketing data: UTM parameters (source, medium, campaign)
• Custom events: If configured by the website owner

How We Process IPs

When processing visitor data, IP addresses are only used temporarily to determine geographic location (country and region). The actual IP addresses are never stored in our database, preserving visitor anonymity while still providing geographic insights to website owners.

User and Session IDs

Rybbit uses anonymous session and user identifiers that contain no personally identifiable information. These IDs help track user journeys and session information without compromising privacy or requiring cookies.

No Cookies Policy

Unlike traditional analytics tools, Rybbit functions without cookies. This means websites using Rybbit typically don't require cookie consent banners under GDPR, ePrivacy Directive, and similar regulations.

How Data is Used

The collected data is used exclusively to:

• Provide website owners with anonymous, aggregated statistics about their visitors
• Show trends in website traffic and user behavior
• Help identify popular content and effective referral sources
• Track marketing campaign performance
• Understand user flows through websites

Data Ownership

For self-hosted Rybbit instances, all collected data remains exclusively on your servers and under your control. For our cloud service, you retain ownership of your analytics data, and we process it solely to provide the analytics service to you.

Data Retention

For self-hosted instances, data retention is configurable by the administrator. For our cloud service, we retain analytics data for 12 months by default, after which it is automatically deleted.

GDPR and Privacy Regulations Compliance

Rybbit is designed with privacy regulations in mind, including GDPR, CCPA, and ePrivacy Directive:

• We collect minimal data needed for analytics
• We don't use cookies or local storage
• We don't track users across different websites
• We don't collect or store personal data that could directly identify individuals
• We don't share or sell your analytics data

Security Measures

For our cloud service, we implement appropriate technical and organizational security measures to protect your data. For self-hosted instances, security is managed by your administrators.

Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or for legal reasons. We will post the updated policy on this page with a revised date.

Open Source Transparency

As an open-source project, our code is publicly available for review. This includes our data collection mechanisms, which you can audit to verify our privacy claims.View our GitHub repository.

Contact Us

If you have questions about this privacy policy or Rybbit's data practices, please contact us at:hello@rybbit.io