Recording a session is a solved problem: rrweb captures DOM events and replays them, and a click heatmap is a table of coordinates drawn over a screenshot. For one site with a few thousand sessions a month, an agent builds the collector, the player, basic heatmaps and funnels in a sitting or two. The weekend goes on what makes it safe and useful: masking form fields and personal data before they leave the browser, heatmaps that stay aligned across screen sizes and page changes, friction scoring, and storage that doesn't balloon. Mouseflow's AI summaries, surveys and integrations are further builds.
Before you buildMouseflow's Free plan records 500 sessions a month for one project with a month of data; Microsoft Clarity is free without a session cap. Check whether either is enough before building.
Build me a self-hosted session recorder and heatmap tool to replace Mouseflow on my own site. Requirements: - Node.js 22 + TypeScript: a Fastify collector and dashboard. `npm start` serves http://localhost:4860, and the tracking script is served from /t.js with one script tag. - Capture in the browser with `rrweb`: DOM changes, mouse moves, clicks, scrolls and inputs. Mask all inputs and anything with a data-private attribute by default and never record password fields. Batch events and send them with `navigator.sendBeacon` every 5 seconds. - Collector: POST /collect takes event batches per session id, checks the Origin against ALLOWED_ORIGINS in .env, rate-limits per IP and rejects batches over 512 KB. - Storage: better-sqlite3 in ./data/sessions.db for session metadata (start, duration, URL, device width, browser, referrer, UTM, pages, rage-click count) and gzip event files under ./data/events/. A nightly job deletes sessions older than RETENTION_DAYS (default 30). - Sampling: SAMPLE_RATE in .env records a percentage of sessions, Do Not Track is honoured and `window.noTrack()` stops recording. - Dashboard behind a basic-auth password from .env: a session list filtered by URL, duration, device and rage clicks, with a player built on `rrweb-player` and speed control. - Heatmaps: click and scroll-depth maps for one URL drawn over Playwright screenshots taken at 1440, 768 and 390 px wide. Funnels: steps defined as URL patterns, with drop-off per step. - Friction: flag rage clicks (3 or more within 700 ms inside 40 px) and dead clicks (no DOM change within 1 s). - Single user. No accounts, no third-party calls, no telemetry. Out of scope: surveys, AI summaries, several sites or teams, form-field analytics, cross-domain tracking. - README: adding the script tag, what is captured and masked, and a reminder that EU visitors need a consent notice before recording.
Opens your agent with the prompt filled in, you press enter. Or copy it and paste it into an empty folder.
The first prompt builds the core. Run these one at a time in the same folder to grow it into your own Mouseflow.
Add segments to the session recorder in this folder. Requirements: - Save named filters (UTM source, device class, country from an offline GeoLite2 database file, new or returning, min duration) and apply them to the session list, heatmaps and funnels. - Show a comparison view with two segments side by side for one heatmap or funnel. - Never send IP addresses to any outside service; discard the IP after the country lookup. - Update the README with where to put the GeoLite2 file.
Add custom events to the session recorder in this folder. Requirements: - `window.track(name, props)` in the tracking script stores an event on the session timeline; props are limited to 10 string or number values. - A goals page that counts sessions reaching an event, with conversion rate per day. - Show event markers on the player's timeline and let me filter sessions by 'did X' or 'did not do X'. - Update the README with examples.
Harden privacy in the session recorder in this folder. Requirements: - A CSS selector allowlist and blocklist in .env for what is masked or unmasked, applied in the browser before sending. - A "forget this visitor" command that deletes all sessions for a visitor id, and a consent mode where the script records nothing until `window.recordConsent(true)` is called. - Strip query-string values named in a QUERY_REDACT list from stored URLs. - A test page that proves a typed email address never appears in stored events. - Update the README.
Most of what you pay for is not running a recording pipeline: a script tag is pasted once, sessions are masked and stored, and the vendor keeps up with browsers and privacy rules. Marketing teams get heatmaps and funnels without a developer. Reviews say price grows with traffic, which is where free tools start to look good.
Estimate · A $5 VPS holds a few thousand compressed sessions a month; heavier sites need more disk. The build is token usage on your agent plan.
| Plan | Monthly | Annual, per month | What you get |
|---|---|---|---|
| Free | $0 | $0 | 500 sessions a month, 1 project, 1 month of data retention. |
| Essential | $25 | — | 5,000 sessions a month, 1 project, 3 months of data retention. |
| Advanced | $109 | — | 25,000 sessions a month, 2 projects, 6 months of data retention. |
| Premium | $319 | — | 100,000 sessions a month, 5 projects, 12 months of data retention, REST API access. |
| Enterprise | custom | — | Custom sessions, projects and retention. |
Free forever: 500 sessions a month, 1 project and 1 month of data retention, with limited features.
Kinda. The core is a weekend build with the prompt on this page, but real gaps remain: Friction detection that ranks problems by impact across all recordings, Ask Mina AI answers, AI insights and the MCP server over your behavior data.
About $25 a month on the Essential plan, $300 a year (checked 2026-10-19).
Friction detection that ranks problems by impact across all recordings; Ask Mina AI answers, AI insights and the MCP server over your behavior data; Feedback surveys and field-level form analytics; Heatmap comparisons across time periods, devices and visitor segments; A Danish vendor maintaining anonymization and compliance controls. If any of those matter to you, keep paying.
Yes: Microsoft Clarity (free), OpenReplay (open source), PostHog (open source).