Rybbit

Active

Rybbit is an open-source web analytics tool under AGPL-3.0, hosted or self-hosted; the cloud keeps analytics data on Hetzner servers in Germany and Finland, with Cloudflare used for delivery and file storage. It sets no cookies but creates a persistent visitor ID in local storage by default, and hosted plans are sized by pageviews.

Web analytics
Cloud or self-hosted
Based in United States
Founded 2025
Checked 17 Sep 2026

Visit website ↗Similar tools

Tracking script

10.6 KB compressed

33.2 KB uncompressed · measured 17 Sep 2026

Heavier than 27 of the 39 other measured scripts. Each line is one tool; hover to see which.

Price

From$19/mo

At 100k pageviews$19/mo

Billed by pageviews · checked 17 Sep 2026

Cheapest monthly price for each published traffic level, in pageviews. Hover a point for the plan.

Privacy and data

Cookies: Stored ID
Data location: EU
Self-hosting: Available
Source code: Open source

Plans

Free plan: No
Billing unit: Pageviews
Sites on entry plan: Depends on plan
Data retention: 3 years

Strengths

Block Bot Traffic filters detected bots before they reach reports, using user-agent patterns, header checks and further layers, and the documentation says filtered bot visits are not billed.
Autocapture can record outbound clicks, JavaScript errors, button clicks, copied text and form interactions, and data-rybbit-event attributes send custom events with properties straight from HTML.
Site settings exclude traffic by IP address or range, country, path, hostname and user agent, and the exclusions apply on the server before anything is stored.
Public Analytics opens one site’s dashboard to anyone in read-only mode, and embeds can show a live visitor widget or the whole dashboard through a private link.
Attributes on the script tag can skip or mask URL paths by pattern, and a proxy guide covers serving the script from your own domain with Next.js, Nginx or Caddy.

Watch-outs

The script sets no cookies but stores a random visitor ID in the browser’s local storage, although the privacy policy says Rybbit uses neither cookies nor local storage.
By default, visitors are identified by a hash of IP address and user agent without a daily salt. User ID Salting adds one, and the documentation says the retention page then becomes effectively useless.
Plans are sold by monthly pageviews, but the documentation calls the allowance a monthly event limit, and Rybbit’s code counts custom events, outbound clicks and performance measurements toward it as well.
Once an organization exceeds its monthly limit, the dashboard asks the owner to upgrade to continue collecting analytics, and Rybbit stops recording events for its sites.
Session replays require Pro in the cloud, and a self-hosted installation lacks the Pages view and the email reports of the cloud version.

Who it suits

Rybbit is open-source web and product analytics under AGPL-3.0, offered as a hosted service by Tomato.gg LLC in the United States or for self-hosting. Beyond traffic reports, the Standard plan’s feature list includes sessions, user profiles, funnels, journeys, retention, goals, page performance metrics and JavaScript error tracking.

Plans are sized by monthly pageviews. Standard covers up to five websites and three team members; Pro removes both limits and adds session replays, and Enterprise adds single sign-on, a dedicated instance and on-premise installation.

The hosted service keeps analytics data on Hetzner servers in Germany and Finland. For what self-hosting involves, see open-source tools you can self-host.

Setup

Add a site in the Rybbit dashboard to get a script tag with the site ID in its URL, and place it in the head section of every page. Options such as page changes in single-page apps, outbound links, error tracking and performance metrics are switched on in the site settings rather than in code. There is no official WordPress plugin; the guide suggests the third-party WPCode plugin or your theme files.

To self-host, you need a VPS with at least 2 GB of RAM, Docker Engine and a domain with HTTPS. The setup script starts ClickHouse, PostgreSQL, Redis, the Rybbit services and a Caddy web server; on ARM, ClickHouse needs ARMv8.2-A or newer.

Single snippet
WordPress plugin
First-party proxy
Public API
Data export
Search Console
Email reports (partly)
Public dashboard

Moving from another tool

Rybbit imports historical data from Umami and Simple Analytics CSV exports and from Plausible’s ZIP export, under the Import tab in the site settings. In the cloud, the plan decides how far back an import can reach, and older events are skipped.

Imported events count toward the monthly event limit, so an import close to the limit may be partly skipped, and only one import per organization runs at a time, for up to two hours. Self-hosted installations have no such restrictions.

Features

As documented on the vendor’s own pages. “Partly” means the feature has limits or is only on some plans.

Tracking & Reporting

Pageviews & visitors: yes
Live visitor count: yes
Top pages report: yes
Top referrers: yes
UTM campaign tracking: yes
Country & city breakdown: yes
Device, browser, OS: yes
Bounce / engagement: yes
Time on site: yes
Custom events: yes
Goals / conversions: yes
Funnels: yes
Outbound link tracking: yes
File download trackingPartly
404 / error tracking: yes

Pricing & Plans

Unlimited sites on entry planPartly

Privacy & Compliance

Cookieless by default: no
No personal data collected (vendor’s position)Partly
No consent banner needed (vendor’s position): yes
Data hosted in EU: yes
Data hosted in USPartly
Self-hostable: yes
Open source: yes
Data retention3 years
Bot & spam filtering: yes

Setup & Integrations

Single-snippet install: yes
WordPress plugin: yes
Proxy / first-party domain: yes
Public API: yes
Data export (CSV/JSON): yes
Google Search Console connector: yes
Email digestsPartly
Slack / webhook alerts: no
Public shareable dashboard: yes

Platforms & frameworks

What the vendor documents. A platform that is not listed has no guide, plugin or package from the vendor.

Shopify: yes
WooCommerce: yes
Ghost: yes
Webflow: yes
Squarespace: yes
Wix: yes
Drupal: yes
React: yes
Next.js: yes
Vue / Nuxt: yes
Static sites (GitHub / GitLab Pages): yes
Google Tag Manager: yes
Server-side tracking: yes

Questions and answers

Does Rybbit use cookies?

No cookies, but the tracking script stores a random visitor ID in the browser’s local storage, and the server recognizes visitors by a hash of IP address and user agent. The privacy policy says sites using Rybbit typically need no cookie consent banner; whether that holds for your site depends on the rules that apply to you.

Is there a free Rybbit plan?

No. Hosted plans start with a 7-day free trial, and the pricing page says no card charges are made until it ends. The open-source code can be self-hosted without a license fee.

What happens when I exceed the monthly limit?

Tracking stops. According to Rybbit’s source code, owners get an email once the organization goes over its limit, the dashboard asks them to upgrade, and events for its sites are not recorded until the plan changes or a new calendar month begins.

Where does Rybbit store data?

In Germany and Finland. The subprocessor list places analytics data on Hetzner servers there, while Cloudflare provides the content delivery network, DNS and object storage, including session replay recordings. AI-assisted features send data to Anthropic or OpenAI only when you use them.

Sources and checks

Status: Active, checked 17 Sep 2026
Prices: Checked 17 Sep 2026 on the vendor’s pricing page ↗
Tracking script: Measured 17 Sep 2026: downloaded and compressed the same way for every tool
Features: From the vendor’s pages, checked 19 Sep 2026
This page: Text updated 17 Sep 2026

How each value is collected: methodology. Why tools get no overall score: our reasoning.