Rybbit: A Self-Hosted Analytics Stack That Puts Sessions and Replays First

What Rybbit Actually Solves

Rybbit targets the gap between simple, privacy-friendly counters like Plausible and the heavyweight, cookie-laden GA4. The README positions it as an open-source and privacy-friendly alternative to Google Analytics, with a focus on being intuitive. The core problem it solves is twofold: giving site owners a cookieless tracking method that avoids consent banners, and providing deep behavioral analytics like session replays, funnels, and user journeys, which simple tools often lack. The intended users are product teams and site operators who want full control over their analytics data, either through a hosted service or on their own VPS, and who need more than pageview counts. The inclusion of session replays and user profiles suggests a product analytics focus, not just marketing analytics. That is a distinct niche: Plausible deliberately avoids session-level data, while Rybbit embraces it.

How Rybbit Works Under the Hood

The README does not expose the internal architecture, but the feature list reveals the data flow. Rybbit collects standard metrics like sessions, unique users, pageviews, bounce rate, and session duration, all without cookies. It also captures session replays, which implies a script that records DOM changes or mouse movements, then sends them to the server. The platform supports custom events with JSON properties, so the tracking script must handle arbitrary structured data. Location tracking works at three levels, country, region, and city, which suggests IP-based geolocation on the server side. The real-time dashboard indicates a streaming or polling mechanism for live updates. The advanced filtering across 15+ dimensions means the data model is relational or columnar, allowing queries on multiple attributes simultaneously. The presence of funnels, retention, and user journeys implies event sequencing and cohort analysis. The repository is TypeScript, so the entire stack, from tracking script to dashboard, is likely a Node.js application. Without deeper documentation, the exact data pipeline remains unclear, but the breadth of features points to a substantial backend.

Getting Rybbit Running

The README offers two paths: the hosted service at rybbit.com, which is described as the fastest way to get started, and self-hosting, which is documented at rybbit.com/docs/self-hosting. The self-hosting option requires deploying on your own VPS, but the README does not provide the actual commands or configuration keys. It only says to explore the documentation for installation, configuration, and usage. This is a notable gap: a project that claims to take only a couple of minutes to set up should at least mention a Docker command or a npm install line. The demo at demo.rybbit.com/81 shows a real-life production site, which is useful for evaluating the UI before committing. For a developer, the lack of quick-start commands in the README is a friction point. You will need to visit the external docs to get the exact steps, which may include setting environment variables for database connections, secret keys, and domain configuration. The release cadence, with v2.8.0 pushed on 2026-07-27, suggests active maintenance, but the setup process remains opaque from the repository alone.

Where Rybbit Falls Short

The most obvious limitation is the AGPL-3.0 license. For a company that wants to embed Rybbit into a proprietary product or modify it internally, the AGPL imposes strong copyleft obligations, especially if the software is offered as a network service. This is a genuine barrier for many commercial adopters. Another limitation is the session replay feature itself. While it is a powerful debugging and UX tool, it also captures user behavior at a granular level, which can be a privacy risk. The README claims privacy-friendly and cookieless, but session replays inherently collect sensitive data like mouse movements and keystrokes (though likely not password fields). This could conflict with privacy regulations like GDPR if not handled carefully. The comparison table shows Web Vitals as cloud-only, meaning self-hosters lose that feature. So the self-hosted version is not fully featured. Also, the README's comparison table includes a 'Frog' feature, which is a joke, but it highlights that the table is not entirely serious. The absence of a clear data retention policy or anonymization details in the README is another concern. For a tool that positions itself on privacy, the documentation should be explicit about data lifecycle.

Rybbit vs. Plausible: Two Different Privacy Philosophies

Plausible is the most direct open-source competitor, but the two projects take opposite approaches to privacy. Plausible is cookieless and does not use any client-side tracking that could identify individual users; it aggregates data at the pageview level. Rybbit also avoids cookies, but it goes far beyond aggregation by recording session replays and building user profiles. That is a fundamental difference. If your privacy policy promises no personal data collection, Plausible is the safer choice. If you need to understand individual user behavior, such as where users drop off in a funnel or what a session actually looked like, Rybbit offers that depth. The trade-off is clear: Rybbit provides richer data but at the cost of more intrusive tracking, even if it is cookieless. The README's comparison table acknowledges this by listing Session Replays and User Profiles as features that Plausible lacks. The 'Community Edition' footnote for Plausible also notes that its self-hosted version is limited compared to the cloud, whereas Rybbit's self-hosted version appears to include most features except Web Vitals. So for self-hosters, Rybbit may offer a more complete feature set, but with a heavier privacy footprint.

Maintenance and Upgrade Considerations

The repository shows regular releases: v2.8.0 on 2026-07-27, v2.7.0 on 2026-07-07, and v2.6.0 on 2026-05-14. That is a roughly monthly cadence, which indicates active development. For self-hosters, this means frequent upgrades, which can be a maintenance burden, especially if the project does not provide a simple upgrade path. The README does not mention database migrations or backup strategies, so you will need to plan for that. The AGPL license also has implications for maintenance: if you modify the code and deploy it as a network service, you must release your changes under AGPL. That could deter some teams from customizing the tool. The documentation is external, so the maintenance cost also includes keeping up with changes in the docs. The lack of a clear versioning policy or changelog in the README means you will have to check the release notes on GitHub. Overall, the project seems actively maintained, but the upgrade process is not documented in the repository, which adds friction for self-hosters.

Editorial conclusion

Adopt Rybbit if you need a self-hosted, cookieless analytics platform with session replays, user journeys, and advanced filtering, and if your team can handle TypeScript and AGPL obligations. Avoid it if you want a fully managed service, a permissive license, or if your privacy requirements forbid session replay data collection. Before deployment, verify the self-hosting documentation for resource requirements, check the AGPL implications for any modifications, and confirm that the session replay feature can be disabled or scoped to comply with your data protection policies.

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes