Rybbit Review (2026)

Session replay in a privacy-first tool — that's the rare combination. Pro tier ($26/mo) bundles rrweb-based replay alongside cookieless tracking. Plausible/Fathom/Umami don't ship replay at any price; for visual UX debugging without third-party tools (Hotjar, FullStory), Rybbit is the only direct option in this category.

Out-of-the-box feature breadth. Funnels, retention cohorts, Web Vitals, JavaScript error tracking, click autocapture, outbound-link tracking, 3D globe visualization — all in the base Standard plan ($13/mo). Plausible gates funnels behind its $39 Business tier; Umami's funnel feature is a v3.1 Custom Boards add-on. Rybbit treats this as table stakes.

Self-host without compromise. AGPL-3.0 with Docker Compose installer. ClickHouse backend handles 20M+ pv/mo on commodity hardware. 12k+ GitHub stars in the first year — active community, not a dormant repo. EU-only Cloud (Germany) for teams that want hosted; either path keeps data out of US infrastructure.

No permanent free SaaS tier. Just a 7-day Cloud trial — after that you either pay $13/mo or self-host. Umami Hobby and GoatCounter Cloud both have free SaaS tiers. For "I just want to see if this works on my blog without a credit card," Rybbit Cloud is the wrong pick.

ClickHouse + 2GB RAM minimum. Heavier than Plausible (Elixir + ClickHouse, ~1GB workable) and substantially heavier than Umami (Postgres/MySQL on a $5 VPS) or GoatCounter (single Go binary, ~256MB RAM). The richer feature set is the trade-off — but on a small VPS, Rybbit will dominate the resource budget.

No third-party security certifications. SOC 2, ISO 27001, HIPAA all absent. Founded 2025, AGPL-licensed, no public DPA URL or click-through signing flow. Procurement teams with attestation requirements will need Matomo Cloud (ISO 27001) or Piwik PRO (ISO 27001 + SOC 2 + HIPAA BAA) instead.

DNT signal handling not documented. Vendor's privacy policy doesn't address how Do Not Track is handled — visitors who want opt-out rely on browser ad-blockers. Track record is short: 2025 launch, limited operational history under load.

Best for engineering teams that want one tool for web analytics + session replay + Web Vitals + error tracking, all under AGPL self-host. The "I'm tired of paying for Plausible AND Sentry AND Hotjar" use case is exactly what Rybbit targets.

Real value at the $26 Pro tier — that's where session replay (rrweb), unlimited sites, and 5-year retention unlock. Standard at $13/mo is the cheaper option if you don't need replay; Self-host on your own VPS is $0 if you can carry the ClickHouse/2GB-RAM operational cost.

Not for content sites/blogs (Plausible is cheaper and lighter), procurement-heavy enterprises (no SOC 2/ISO 27001), tiny VPS deployments (Umami or GoatCounter fit better), or teams without DevOps capacity to run Docker + ClickHouse.

Self-host via Docker Compose. Vendor ships an automated installer that provisions Caddy + ClickHouse + Node.js on a blank VPS. Manual mode for existing reverse proxies is documented. Minimum specs: 2GB RAM, x86_64 or ARMv8.2-A+, Docker.

Cloud setup is one snippet. Sign up, get a tag from the dashboard, paste it into your site's . Auto-tracks pageviews, SPA route changes, outbound links, file downloads. ~3 KB tracker.

Custom events via JS API or HTML attributes — data-rybbit-event for click capture, rybbit.event('name', {props}) for programmatic. Funnels are configured in-dashboard from the captured events.

Session replay (Pro tier) requires no extra setup beyond enabling it on the site config — the bundled rrweb library captures DOM mutations server-side. First-party proxy via custom subdomain is documented for ad-blocker resilience.

No native GA4 importer. Vendor mentions "Data Import" in docs but doesn't ship a one-click GA4 history pull. Migration is forward-looking: drop the Rybbit snippet, optionally dual-tag with GA4 for a few weeks to align metrics, then sunset GA4.

Re-define funnels and goals. GA4's hit-based event model doesn't map 1:1 to Rybbit's funnel/conversion schema. Plan to redefine 5-15 critical events using rybbit.event() and rebuild conversions from scratch.

Cookie banner removal is the immediate win. Rybbit is cookieless by default — no consent prompt required for GDPR/CCPA/PECR (subject to per-jurisdiction interpretation; Italy's Garante is the strictest). On most sites this delivers a measurable conversion-rate lift within 2-4 weeks of dropping GA4.

Optional: enable session replay (Pro tier) before the GA4 sunset — gives you visual debugging that GA4 never offered, useful during the transition for catching tracking gaps.