Open Source Hotjar Alternative: Self-Hosted Session Replay with AI

Session replay has become a standard tool for product teams. Watching real users interact with your application reveals usability problems, conversion blockers, and bugs that analytics dashboards cannot surface. But the market leaders — Hotjar and FullStory — come with significant trade-offs that are driving teams toward open source Hotjar alternatives.

This article examines why teams leave commercial session replay tools, how FeedbackLoop AI works as a self-hosted replacement, and what makes it technically different from the tools it replaces.

Why teams leave Hotjar and FullStory

The decision to migrate away from a commercial session replay tool is rarely impulsive. It accumulates over months of encountering the same limitations. Here are the four most common reasons teams make the switch.

Cost escalation

Hotjar's pricing starts at $80/month for their Business plan, but scales rapidly with pageviews. Teams with moderate traffic (50K–100K daily sessions) routinely see bills of $200–400/month. FullStory does not publish pricing, but enterprise contracts typically start at $10,000+/year and scale with session volume.

For startups and small product teams, this creates a painful choice: either pay a significant monthly fee for a tool that provides visibility into user behavior, or fly blind. A self-hosted session replay solution eliminates this trade-off entirely. Your cost is your server — which you likely already have.

Privacy and data sovereignty

When you use Hotjar or FullStory, your users' session data is stored on third-party servers. For teams operating under GDPR, CCPA, or sector-specific regulations (healthcare, finance, government), this creates compliance complexity. You need Data Processing Agreements, you need to document data flows, and you need to trust that the vendor's infrastructure meets your regulatory requirements.

With a self-hosted solution, the data never leaves your infrastructure. There is no third-party processor. There is no cross-border data transfer. Your DPO signs off on it once, and the compliance question is resolved permanently.

Data ownership and portability

Commercial session replay tools store your data in their proprietary format. If you cancel your subscription, your historical data is typically deleted after a grace period. You cannot export raw session recordings. You cannot build custom analysis pipelines on top of the data. You are locked into whatever features the vendor decides to build.

A self-hosted open source alternative stores data in standard formats on your own servers. You own it. You can query it, export it, build custom tooling around it, and keep it forever.

Feature gaps

Hotjar excels at heatmaps and basic feedback forms, but lacks AI-powered analysis, console error capture, and integration with CI/CD pipelines. FullStory has powerful search and segmentation, but no built-in feedback widget and no autonomous pipeline. Neither tool connects the dots between user feedback, session context, and the development workflow.

FeedbackLoop AI: feature overview

FeedbackLoop AI is an open source, self-hosted platform that combines session replay, AI-qualified feedback, frustration detection, and an autonomous development pipeline into a single deployable tool. It is MIT-licensed and free to use without restrictions.

• Session replay: Full DOM recording via rrweb. Every click, scroll, input, navigation, and page transition captured and replayable in the dashboard.
• AI feedback widget: An embeddable conversational widget that uses AI to qualify user feedback through targeted follow-up questions. Automatically categorizes, prioritizes, and extracts reproduction steps.
• Frustration detection: Algorithmic detection of rage clicks, dead clicks, and scroll rage — surfacing user frustration that goes unreported.
• Deep AI analysis: A two-pass AI system that identifies root causes, estimates fix complexity, and generates executive-level reports.
• Autonomous pipeline: From feedback submission to Linear issue to CI/CD trigger to production deployment — with human approval as the only gate.
• Console and network capture: JavaScript errors, unhandled promise rejections, and failed network requests logged alongside every session.

Technical deep dive: how rrweb recording works

Understanding the recording mechanism is important when evaluating any session replay tool, because it directly affects performance, accuracy, and privacy. FeedbackLoop AI uses rrweb (record and replay the web), the industry-standard open source library for DOM recording.

Initial DOM snapshot

When a recording session begins, rrweb takes a complete serialized snapshot of the current DOM. This snapshot captures every element, attribute, style, and text node as a JSON structure. The snapshot serves as the baseline state for the recording.

This serialization process is non-blocking and typically completes in under 50ms for a complex page. The serialized output uses a compact format that assigns incremental IDs to each node, allowing subsequent mutations to reference nodes by ID rather than repeating their full structure.

Incremental mutations

After the initial snapshot, rrweb attaches a MutationObserver to the document. Every DOM change — added elements, removed elements, attribute changes, text changes — is captured as an incremental mutation event with a precise timestamp.

User interactions (mouse movements, clicks, scrolls, input changes, viewport resizes) are captured as separate event types. These events are lightweight: a click event, for example, is just a node ID, coordinates, and a timestamp.

// Simplified rrweb event structure
{
  "type": 3,           // IncrementalSnapshot
  "timestamp": 1709042567123,
  "data": {
    "source": 2,       // MouseInteraction
    "type": 2,         // Click
    "id": 247,         // Target node ID
    "x": 512,
    "y": 340
  }
}

This architecture means that session recordings are extremely efficient. A typical 5-minute session generates only 200–500KB of compressed data, compared to the megabytes that a video recording would require.

Replay reconstruction

During replay, rrweb reconstructs the page by applying the initial snapshot to an iframe, then replaying each incremental event in sequence at the original timestamps. The result is a pixel-perfect reconstruction of what the user saw, including CSS animations, hover states, and dynamic content.

Privacy-first: GDPR compliance by design

Privacy is not a feature toggle in FeedbackLoop AI — it is a design principle that runs through every layer of the system.

Self-hosted data residency

When you self-host FeedbackLoop AI, all session data is stored on your infrastructure. Session recordings stay in your PostgreSQL database and local filesystem. There is no phone-home, no telemetry, no third-party data transfers. For GDPR compliance, this is the simplest possible architecture: you are both the data controller and the data processor.

IP anonymization

FeedbackLoop AI anonymizes IP addresses by default. The last octet of IPv4 addresses is zeroed (192.168.1.42 becomes 192.168.1.0). This preserves country-level geolocation accuracy for analytics while preventing individual user identification through IP addresses.

Element-level masking

Sensitive content can be masked at the HTML element level using data attributes:

• data-hl-mask — Replaces text content with asterisks in the recording. The element structure is preserved, but the actual text is never captured.
• data-hl-block — Blocks the entire element from being recorded. It appears as an empty placeholder in the replay.
• data-hl-ignore — Excludes the element from input recording. Useful for forms where you want to show the UI but not capture typed values.

Password fields (<input type="password">) are masked by default with no configuration required. This applies globally and cannot be overridden.

Bot filtering

Automated traffic is filtered through a three-layer detection system to prevent bots from polluting your session data:

1. User-agent matching: Over 20 known bot patterns (Googlebot, Bingbot, AhrefsBot, etc.) are filtered on the client side before recording begins.
2. Reverse DNS lookup: On the server side, incoming requests are checked against 50+ datacenter hostnames associated with automated traffic.
3. ASN checks: IP ranges belonging to major cloud providers (AWS, GCP, Azure, Cloudflare, OVH) are flagged as likely bot traffic.

Frustration detection: catching what users do not report

Most usability problems go unreported. Users encounter friction, get frustrated, and either work around the problem or abandon the task entirely. FeedbackLoop AI detects three distinct frustration signals algorithmically, without any user action.

Rage clicks

A rage click is defined as 3 or more clicks on the same element within 1 second. This pattern almost always indicates a non-responsive UI element: a button that does not trigger, a link that does not navigate, or an interactive element that appears clickable but is not. Each rage click event is scored on a 0–100 frustration scale based on click frequency, element type, and session context.

Dead clicks

A dead click occurs when a user clicks an element and no DOM mutation occurs within 2 seconds. This indicates that the user expected something to happen (a modal to open, a page to load, a form to submit) but the UI did not respond. Dead clicks are a strong signal of broken functionality or misleading UI affordances.

Scroll rage

Scroll rage is detected when a user performs 3 or more scroll direction reversals within 2 seconds. This rapid back-and-forth scrolling indicates confusion: the user is searching for content they cannot find, or the page layout does not match their expectations. Scroll rage often points to information architecture problems rather than code bugs.

Each frustration event is attached to the session recording at the exact timestamp where it occurred, allowing developers to jump directly to the moment of frustration during replay review.

Installation in 5 minutes

FeedbackLoop AI is designed to deploy quickly on any Linux server. The minimal requirements are Node.js, PostgreSQL, and Redis. A Docker Compose configuration is included for Redis and MinIO (object storage for video renders).

The basic installation flow:

1. Clone the repository and install dependencies
2. Configure your .env file with database credentials and an OpenRouter API key (for AI features)
3. Run Prisma migrations to set up the database schema
4. Start the API and worker services via PM2
5. Embed the tracker script on your site

Detailed step-by-step instructions are in the installation documentation. Most teams are recording sessions within 5 minutes of starting the setup process.

Cost comparison

The financial case for self-hosting is straightforward:

For teams already running a VPS or cloud server, the marginal cost of adding FeedbackLoop AI is effectively zero. The only variable cost is the OpenRouter API usage for AI features, which is typically under $5/month for moderate feedback volume.

When to choose self-hosted over cloud

Self-hosted session replay is the right choice when:

• Privacy is non-negotiable: If your users are in the EU, or your product handles sensitive data (health, finance, legal), self-hosting eliminates third-party data processing entirely.
• Cost control matters: If your traffic volume would push a commercial tool into the $200+/month range, self-hosting pays for itself immediately.
• You want full control: Self-hosting means you can customize the recording rules, the AI prompts, the dashboard UI, and the pipeline behavior. Fork it and make it yours.
• You need the autonomous pipeline: The feedback-to-deploy pipeline is a unique capability that no commercial session replay tool offers. If you want to close the loop between user feedback and production fixes automatically, FeedbackLoop AI is the only option.

If you prefer zero infrastructure management and are comfortable with vendor-hosted data, FeedbackLoop AI also offers a managed cloud plan at $49/month with 10K sessions included.

The open source Hotjar alternative space has matured significantly in 2026. Teams no longer need to choose between functionality and data ownership. FeedbackLoop AI demonstrates that a self-hosted tool can match — and exceed — the feature set of commercial products while keeping costs at zero and data under your control.