Privacy Policy — Rybbit analytics (Unofficial)

Last updated: 21 August 2026

Rybbit analytics (Unofficial) (package com.nkshub.rybbit_unofficial) is an unofficial, open-source mobile client for the Rybbit web analytics platform. It is not affiliated with, endorsed by, or operated by the Rybbit team. This policy explains what the app does with your data.

Data you provide

• Server URL of your Rybbit instance.
• Authentication: your email and password, or an API key.

These are stored locally on your device using Android's secure storage (Keystore-backed flutter_secure_storage, with a local fallback). They are never sent to us or to any third party. They are transmitted only to the Rybbit server you configure, in order to sign in and fetch your analytics.

Network

The app talks to the Rybbit server URL you enter, and — unless you switch it off — to the developer's own usage-statistics endpoint described below. The developer receives none of your credentials and none of the analytics data held on your server.

Usage analytics

To see which parts of the app are actually used, the app sends anonymous usage statistics to a self-hosted Rybbit instance operated by the developer at tel.nks-hub.cz. What is sent:

• Screen views as route patterns — for example /analytics/:siteId. The placeholder is never filled in, so the identifiers of your sites are not transmitted.
• App lifecycle events (app opened, foregrounded, backgrounded).
• Actions: sign-in success or failure and sign-out, each labelled only with whether you connected to Rybbit Cloud or a self-hosted server, and whether you used a password or an API key.
• Technical context added automatically: app version, device model, operating system version, language, screen size, and an approximate location derived from your IP address (typically country and city). The IP address itself is not stored.
• A random identifier generated on your device to group events into a session. It is not linked to your Rybbit account.

Never sent: your server address, e-mail, password, API key, account or user id, the names or domains of your sites, or any of the analytics data you view in the app. The app does not call Rybbit's identify function at all, so these statistics are not tied to your identity.

Turning it off: Settings → Privacy → Usage analytics. Switching it off stops all collection immediately, discards anything still queued on the device, and deletes the stored random identifier — so if you ever switch it back on, a new, unlinkable identifier is generated.

Crash reporting

If the app was built with a Sentry DSN, anonymous crash and error diagnostics may be sent to a self-hosted Sentry instance to help fix bugs. This contains technical diagnostic data only (stack traces, device model, OS version) and no credentials or analytics content. Builds without a configured DSN send nothing.

What we do NOT do

• No advertising and no ad identifiers.
• No third-party analytics, tracking or attribution SDKs. The usage statistics above go to the developer's own self-hosted server and to no one else.
• No selling or sharing of personal data.

Data deletion

Uninstalling the app, or signing out, removes all stored credentials from your device. There is no server-side account held by the app developer to delete. Collected usage statistics are anonymous and cannot be traced back to an individual, so they cannot be selectively deleted on request; turning the setting off prevents any further collection.

Open source

This app is released under the AGPL-3.0 license. "Rybbit" is a trademark of its respective owner.

Contact

For questions about this policy, contact the developer via the Google Play listing.