Repo Review: rybbit-io/rybbit

Review note: This analysis is based on repository metadata, documentation, and selected source files. It is not a full security audit. Confidence: high.

Quick facts

GitHub: rybbit-io/rybbit

Primary language: TypeScript

Stars: 12,031

License: AGPL-3.0

Last updated: 2026-04-28T05:50:16Z

Documentation signal: good

Test signal: limited

Maintenance signal: active

What it is

Rybbit is an open-source web and product analytics platform positioned as a privacy-friendly alternative to Google Analytics. The core pitch is simple: keep the useful parts of modern analytics, such as sessions, pageviews, goals, funnels, journeys, retention, user profiles, maps, and realtime dashboards, while avoiding the heavy and often confusing GA4 experience.

The repository has unusually strong adoption signals for a young project: GitHub reports more than 12,000 stars, more than 600 forks, active issues and pull requests, and a latest v2.5.0 release published in March 2026. It is licensed under AGPL-3.0, which matters if you plan to modify and offer it as a network service.

Architecture and stack

The stack is pragmatic for analytics workloads. The client is a Next.js application, the backend is a TypeScript Fastify service, PostgreSQL handles relational application data, and ClickHouse handles analytics event storage and querying. That split is exactly what I would expect from a product that needs normal app behavior plus high-volume analytical reads.

The self-hosting story is also clear. The provided Docker Compose file starts ClickHouse, PostgreSQL, a backend container, a client container, and an optional Caddy reverse proxy profile. The backend exposes configuration for authentication, signup control, telemetry opt-out, Mapbox, and database credentials. This makes the project attractive for homelab users and small teams that want control over analytics data without assembling the stack from scratch.

What looks strong

Rybbit’s strongest point is breadth without immediately sacrificing clarity. The README lists a larger feature surface than minimalist analytics tools: session replay, custom events with JSON properties, error tracking, public dashboards, organizations, advanced filters, advanced map visualizations, retention analysis, funnels, and user journeys. For teams that outgrow pageview-only analytics but still dislike GA4, that combination is compelling.

The technology choices are coherent. ClickHouse is a strong fit for analytics events, PostgreSQL is a sensible fit for accounts and product state, and Docker Compose lowers the barrier for self-hosting. The package manifests also show mature building blocks: Better Auth, Drizzle ORM, rrweb for replay, web-vitals, Mapbox, TanStack Query, Radix UI, and Nivo visualizations.

Maintenance signals are strong. The repository was created in January 2025, had recent pushes in April 2026, has thousands of stars, and the v2.5.0 release added bot blocking improvements, teams, tagging for cohort slicing, and performance improvements. That suggests the project is not just a static dashboard clone but an actively developed product.

Tradeoffs and risks

The biggest tradeoff is operational weight. Rybbit is more capable than a tiny script-plus-dashboard analytics tool, but the self-hosted stack includes multiple services and persistent data stores. If all you need is a very small traffic counter, this may be more infrastructure than you want to maintain.

Session replay, user profiles, city-level location data, and error tracking are powerful, but they also raise privacy and governance questions. Rybbit is privacy-friendly and cookieless by design, but teams still need to decide what they collect, how long they retain it, and what consent or disclosure their jurisdiction and audience require.

The AGPL license is another deliberate choice. It is great for protecting open-source availability, but companies that plan to customize and provide hosted analytics to others should review the license obligations before building on top of it.

Who should try it

Rybbit looks like a strong fit for indie hackers, SaaS teams, agencies, privacy-conscious site owners, and homelab operators who want analytics that are more understandable than GA4 and more product-oriented than basic pageview counters. The hosted option is the fastest path, while the Docker Compose setup gives self-hosters a credible route to full control.

I would especially consider it for projects where funnels, journeys, retention, custom events, and replay matter, but where sending everything to Google is undesirable. If your only requirement is compliance-minimal aggregate traffic reporting, a smaller tool may still be easier.

Bottom line

Rybbit is one of the more interesting open-source analytics projects right now because it does not stop at being a Plausible-style traffic dashboard. It aims at a broader product analytics workflow while preserving the self-hostable, privacy-friendly posture that many teams want.

My read: this is a high-potential project with strong momentum, a sensible architecture, and a useful feature set. The main thing to evaluate before adopting it is not whether it has enough features, but whether you are comfortable operating the stack and making thoughtful privacy choices around richer analytics data.

Limitations

I reviewed public repository metadata, README content, release notes, Docker Compose configuration, and package manifests, but did not deploy the full stack or run the upstream test suite.

Feature comparisons in the README are project-maintained claims, so treat them as positioning rather than an independent benchmark.

The repository is moving quickly, so operational details may change after this review.