Rybbit

Rybbit is an open-source, privacy-friendly analytics platform positioned as a modern, self-hostable alternative to Google Analytics. Its Next.js dashboard sits on top of a Fastify/Node backend that pairs ClickHouse for high-volume event storage with PostgreSQL for relational data, letting it absorb traffic from small blogs and high-traffic SaaS products alike.

Beyond core web-analytics metrics — sessions, pageviews, bounce rate, and session duration — Rybbit layers in features usually reserved for dedicated product-analytics tools: session replay recordings built on rrweb, user journeys, retention curves, funnels, custom goals, and error tracking, all filterable across more than a dozen dimensions including a three-level geographic breakdown (country to region to city) with map visualizations.

Tracking is cookieless by default, so it collects data without triggering cookie-consent banners in most jurisdictions, and self-hosted deployments run entirely on infrastructure the operator controls. The project supports multiple sites under an organization out of the box, and ships an official Docker Compose setup plus a guided install script that gets a first deployment running on a small VPS in well under two hours.

Rybbit is under active, well-funded development — with dozens of tagged releases, near-daily commits, and a growing contributor base — while remaining AGPL-3.0 licensed, so self-hosters keep almost all of the product’s functionality without a license key.

What You Get

• Real-time web analytics dashboard covering sessions, pageviews, bounce rate, and session duration
• Session replay recordings built on rrweb, viewable per-session alongside the analytics data
• Funnels, goals, user journeys, and retention analysis for product-style behavior tracking
• Advanced filtering across 15+ dimensions plus three-level location tracking (country, region, city) with map visualizations
• Custom events with JSON properties and an API for querying analytics data programmatically
• Multi-site and multi-organization support for agencies or teams managing several properties
• Error tracking surfaced alongside traffic data in the same dashboard
• Official Docker Compose stack and a guided setup script for self-hosted installs

Common Use Cases

• Replacing Google Analytics on a marketing site to get cookieless, GDPR-friendly tracking without a consent banner
• Tracking product usage and conversion funnels for a SaaS app without sending user data to a third party
• Debugging UX issues by watching session replays of visitors who dropped off mid-funnel
• Agencies self-hosting one Rybbit instance to report on analytics for multiple client sites under separate organizations
• Monitoring Core Web Vitals and error rates for a production web app in the same dashboard as traffic data

Under The Hood

Architecture Rybbit is a monorepo split into client (Next.js App Router dashboard), server (a Fastify/Node backend), shared (a @rybbit/shared TypeScript package consumed by both), docs (a Fumadocs site), and react-native (a companion mobile SDK). The backend registers dozens of domain-scoped API modules from server/src/api/* (analytics, sites, teams, stripe, gsc, mcp, sessionReplay, admin, experiments, featureFlags) into a single Fastify instance in server/src/index.ts, while the actual business logic lives in server/src/services/*. The tracking pipeline is the clearest example of the architecture’s intent: services/tracker/ingestEvent.ts runs each incoming event through an explicitly ordered, documented sequence of veto stages — site-exclusion check, over-limit check, bot detection, identity/session resolution, then queuing — with the ordering rationale written directly into the module’s docstring rather than left implicit in code. Accepted events are queued (pageviewQueue.ts, Redis-backed) before landing in ClickHouse, while relational and auth data (users, organizations, sites, billing) lives in PostgreSQL via Drizzle ORM. Because nearly every analytics API reads directly from the ClickHouse schema, that schema is the module most other code depends on; changing it would ripple through the whole api/analytics surface.

Tech Stack The backend runs Node.js with TypeScript on Fastify 5, using Drizzle ORM 0.45 over PostgreSQL for relational and auth data, the official ClickHouse client for time-series analytics storage, ioredis for caching and queues, and better-auth 1.7 (with API-key, SSO, OAuth-provider, and MCP plugins) for authentication. Stripe handles billing, Resend plus React Email handle transactional mail, Puppeteer generates PDF reports, rrweb powers session replay recording, and MaxMind’s GeoIP2 client resolves geolocation. The frontend is a Next.js 15 / React 19 App Router dashboard built with TanStack Query, Radix UI primitives and Tailwind CSS, Nivo for charts, and Stripe Elements for billing UI. The whole project uses Vitest for testing, Drizzle Kit for migrations, and ships via Docker Compose, with a separate docker-compose.cloud.yml for the hosted offering and a bundled Caddy config for self-hosted TLS.

Code Quality The codebase is extensively tested — well over a hundred colocated *.test.ts files under server/src alone, using ioredis-mock and @electric-sql/pglite to exercise Redis- and Postgres-dependent code in isolation, plus a comparable suite under client/src. TypeScript is used throughout with Zod for runtime validation at API boundaries, and functions like ingestEvent return discriminated-union result types instead of throwing, making outcomes explicit at every call site. Prettier enforces formatting, knip catches dead code, and a GitHub Actions workflow runs the test suite on every change. Internal comments favor explaining why an ordering or decision exists (as in the ingestion pipeline) rather than restating what the code does, which is a comprehensive quality signal for a project of this size.

What Makes It Unique Most self-hosted, privacy-friendly analytics tools pick a lane: lightweight web analytics (Plausible, Umami) or full product analytics (PostHog). Rybbit deliberately straddles both, pairing cookieless pageview tracking with session replay, funnels, user journeys, retention curves, and error tracking in one dashboard, backed by a ClickHouse-plus-Postgres architecture built to hold up at scale. It also ships a Model Context Protocol server out of the box, letting AI tools query analytics data directly — a forward-looking touch that’s still uncommon in this category.

Self-Hosting

Licensing Model AGPL-3.0 licensed. Because AGPL treats providing network access to a modified version as distribution, anyone who modifies Rybbit and offers it as a network service must make that modified source available to its users.

Self-Hosting Restrictions

• No “Pages View” report (cloud-only, per Rybbit’s own self-hosted-vs-cloud comparison)
• No built-in email reports (cloud-only)
• Google Search Console integration works self-hosted but requires configuring your own Google OAuth credentials, rather than being pre-wired as it is on cloud

Enterprise Features

• Rybbit’s cloud offering gates full session replay behind its paid “Pro” tier — self-hosted deployments get full session replay for free, with no tier restriction
• Cloud adds Pages View reporting and automated email reports not present in the self-hosted build

Cloud vs Self-Hosted Core analytics, funnels, goals, journeys, retention, error tracking, the API, and organizations/teams are identical between cloud and self-hosted. The differences are limited to two cloud-only convenience features (Pages View, email reports) and one feature that’s more restricted on cloud than self-hosted (session replay, free self-hosted vs. paid-tier on cloud).

License Key Required No — there is no license-key gate or separate enterprise-edition directory in the codebase; self-hosted installs run the full feature set out of the box.