RybbitL Open source Google Analytics replacement

Original Article ↗ Hacker News Discussion ↗

Positioning vs existing tools

  • Comparisons focus on Plausible, Umami, Matomo, PostHog, Fathom, Simple Analytics, etc.
  • Rybbit is pitched as more feature-rich than Plausible (e.g. funnels) while staying intuitive, and fully open source (AGPL) without a separate “enterprise-only” feature split.
  • Some see it as very similar to Umami (TypeScript/Next.js, minimal UI); creator says it’s written from scratch with a similar stack.
  • Rybbit currently has only a trial for hosted use, but the creator plans to add a free tier and is undecided on monetization. Goal is to “fill the space” between simple privacy tools (Plausible) and heavy product suites (PostHog).

Privacy, IP addresses, and GDPR/ePrivacy

  • Rybbit advertises cookie-less, GDPR-compliant tracking but relies on IP-based identification (with optional IP hashing and salting).
  • Long debate on whether hashed IPs are “anonymous.”
    • One side: hashing (even with salt) is pseudonymization; IPs are personal data per EU case law; processing them at all triggers GDPR, and ePrivacy may require consent even if data is deleted quickly.
    • Others argue enforcement is inconsistent, law is unclear/being revised, and privacy-focused analytics are acting in the spirit of GDPR.
  • It’s noted that Rybbit’s non-salted mode (supporting retention reporting) may conflict with stricter ePrivacy interpretations, though this is unresolved.

Do you need analytics at all?

  • Some argue the best replacement is “no analytics,” especially for personal sites: fewer scripts, better performance, less ego/vanity.
  • Many push back strongly: marketing and product teams rely on analytics for conversion tracking, feature usage, debugging UX issues, and not wasting spend.
  • Several emphasize that even server-log analysis still raises privacy and consent obligations in the EU.

Server-side and log-based analytics

  • Multiple commenters prefer server-side or log-based tools (e.g. GoAccess, custom scripts) to avoid extra JS and reduce bot inflation.
  • Others note cache layers and bots make raw logs imperfect and that modern tools still offer superior convenience and filtering.

Crowded market and trust

  • The space is seen as heavily saturated, but with many niches: self-hosted vs SaaS, simple vs complex, web vs product analytics, privacy-focused vs ad-tech-heavy.
  • Some prefer open source + self-hosting over sending data to big platforms; others note startups can be acquired, so trust is fragile regardless of size.