SMF·MOUSEFLOW
Can a prompt replace Mouseflow?
Analytics — web and product analytics
Exhibit tracking slip
Verdict
rrweb is open source and genuinely records a session well enough to replay. The reason this is still a no is what happens next: you are now holding a pixel-accurate recording of people typing into your forms, and the responsibility for masking passwords, card numbers, addresses and everything else falls entirely on your configuration. Get one selector wrong and you have logged card details to your own database. Mouseflow's price is largely the redaction defaults and the liability for them.
Exhibit A — The prompt
Received on31.07.2026Build a self-hosted session replay tool for a low-traffic site you own, with privacy as the primary design constraint rather than an afterthought.
Recorder. Use rrweb, loaded only after the host page sets an explicit consent flag; with no consent, the script must not run at all. Configure it in the strictest safe direction and document each choice in the README:
- mask all input values by default, opting fields into visibility one by one rather than the reverse
- block any element carrying a data-noreplay attribute, and every iframe
- mask all text inside elements matching a configurable selector list, defaulting to anything that looks like an account or payment area
- record no network payloads at all
Sample sessions: record a configurable percentage, defaulting to 10 percent, and stop recording a session after a hard cap of 10 minutes.
Ingest and storage. Batch events every few seconds, compress them, and store them in PostgreSQL keyed by session, with a hard retention job that deletes recordings older than a configurable number of days, defaulting to 14. Make deletion of a single session by ID a one-click action, because that is what a data request looks like in practice.
Player. Replay the session with a scrub bar, playback speed, and skip-inactivity. Above the bar, plot a friction timeline: rage clicks (three or more clicks on the same element inside a second), dead clicks (a click on a non-interactive element with no subsequent DOM change), and rapid back-navigation. Let the user jump straight to each marker, because nobody watches a full session.
List view: sessions filterable by page, device, duration and friction marker count.
Out of scope: heatmaps, funnels, surveys, and any cross-site identification. Put a plain warning at the top of the README that this build stores recordings of real people, that the operator is the data controller for them, and that the masking configuration must be tested against a real form before it goes live.Opening prefills the prompt — press enter to run it.
Exhibit B — What you lose
- B.1 redaction rules that are safe by default rather than by your own configuration
- B.2 storage and retention that scales past a low-traffic site
- B.3 the friction score benchmarked against other sites
- B.4 form analytics showing which field people abandon
Prior art
Exhibit C — Why people still pay: data pipeline reliability and analytical depth
Because handling session recordings is a compliance posture, not a feature. A vendor with a data processing agreement, documented retention and an audited redaction default is doing something you would otherwise have to certify yourself.
Questions
Can I bring my Mouseflow recordings over?
No. Recordings are stored in Mouseflow's own format and are not exportable as a replayable stream. Anything you want to keep has to be watched and noted before you cancel; this build starts from zero.
How much storage does this actually need?
An rrweb session on a typical page is a few hundred kilobytes compressed. At 10 percent sampling and a few thousand visits a month that is well under a gigabyte, which is fine. At scale it stops being fine quickly, which is why the prompt caps sampling and enforces retention.
Is this legal to run?
It depends on where your visitors are and what you record, and this entry is not legal advice. What the build does is make consent mandatory, mask inputs by default and enforce retention, which are the mechanics most regimes ask for. The judgement about your specific site is yours, and that transfer of judgement is a large part of what the paid product sells.
What is the one thing that does not survive the rebuild?
Safe defaults. Mouseflow ships knowing which fields to hide because it has seen millions of sites; here, a form field you forgot to mask is recorded in full and you will not find out until you watch the replay.
Related tools
Receipt