Session Replay Self-Host Kit — replay + heatmaps on your own Cloudflare account

Name: Session Replay Self-Host Kit — replay + heatmaps on your own Cloudflare account
Brand: Zicula
Price: 69 USD
Availability: InStock

What's inside the kit

One zip, 25 files — every one is runnable code or documentation: recorder, worker, deploy script, viewer, heatmap, six masking presets, the privacy playbook, the license and five walkthrough screenshots. No placeholders, no "coming soon".

Pipeline

Record → ingest → replay, wired

A pinned rrweb recorder, a Cloudflare Worker that gzips batches into your R2 with a D1 index, and a viewer that plays sessions back. Deploys to your account with one command — bucket, database, schema, ship.

Masking

Mask before capture, by default

maskAllInputs is on from line one; rendered PII hides behind the sr-mask selector; payment iframes are blocked whole. What is masked never leaves the browser — it can't leak later because it was never sent.

Locale presets

TH · JA · ZH · KO · AR · DE

Preset packs with real DOM examples: Thai citizen IDs, Japanese My Number, Korean RRN, Chinese ID numbers, Arabic RTL fields, German IBANs — each with a test checklist so you can verify masking yourself.

Viewer + heatmap

Replay and a click heatmap

A session list from your D1 index, a rrweb-player page, and a canvas heatmap that plots clicks and taps from the same events — a count overlay with a legend, no AI scoring, nothing extra recorded.

GDPR playbook

Consent, retention, residency

A consent gate that initializes nothing until it passes, a retention cron (30/90 days) plus an R2 lifecycle backstop, Cloudflare Access lockdown, and a deletion runbook for data-subject requests.

License

One buyer, any number of sites

A single-buyer commercial license: run it on your projects and your clients'. rrweb is MIT and stays in its own repo — what you're buying is our worker code, presets, viewer and docs.

Kit README with the 30-minute quickstart — README — start here, the 30-minute path

The GDPR/retention playbook — consent, retention, residency

Thai masking preset with DOM examples and test checklist — Thai masking preset — real DOM examples + test checklist

The kit's demo page with masking on by default — The demo page — canonical record snippet, masking on

Real files from the zip, rendered as-is — no mockups.

Who's behind this?

Zicula is a one-person studio — hi, I'm Zic. Every kit here, including this one, is written, tested and shipped through documented process, and the support email is answered by me, not a helpdesk. This store's own build, QA and deploy pipeline runs on the same kind of SOPs and checklists we sell.

Free sample, instant download — no email required.
30-day refund, processed in Stripe — no forms, no interrogation.
Free updates for v1.x — full history in the store changelog.
Real human support: [email protected]

What this kit will not tell you

No legal outcomes for sale. The kit ships a masking-first design, consent gates and retention tooling — the factors courts and regulators actually look at. It does not make any practice compliant by itself, and you should be skeptical of any tool that claims otherwise. Popa v. Microsoft (9th Cir., Aug 2025) shows masking matters in session-replay litigation; it also warns that unmasked financial or medical data is a different case.

No magic dashboard. No AI session summaries, rage scores or funnels — you get the raw replay, a count heatmap and your own judgment. And it is real engineering: a Cloudflare account, one deploy command, about 30 minutes. If you want zero-setup, the free cloud tools are genuinely good at that.

Nothing runs on our side. There is no backend of ours to trust, patch or pay. The worker, the bucket and the database live in your account — that is the product, and it is also why the vendor cannot see your recordings even if it wanted to.

Where does your clickstream live?

Published prices, checked 2026-09-20. The free tools are genuinely free — the difference is who processes the recordings, and on whose infrastructure they end up.

Option	Price (2026 plans)	Where recordings live
Microsoft Clarity	Free forever	Vendor cloud — sessions processed on Microsoft infrastructure
OpenReplay (Dedicated)	$199/mo	OpenReplay cloud / BYOC
LogRocket	From $176/mo at 25K sessions	Vendor cloud
Better Stack	Free 5K replays · $0.0015/replay after	Vendor cloud (US/EU/SG regions), 90-day retention
This kit	$69 once · ~$0/mo at indie scale*	Your own Cloudflare account — worker, storage, index, viewer

*Workers free tier 100k requests/day; R2 10 GB-month free, then $0.015/GB-month, egress free — developers.cloudflare.com, checked 2026-09-20. Clarity/Contentsquare/PostHog/Better Stack/LogRocket/OpenReplay prices from their official pricing pages, retrieved 2026-09-20. Smartlook customers face a platform shutdown on 2027-09-30 (per smartlook.com wind-down FAQ).

From zip to first replay in about 30 minutes

The deploy is one command; the rest of the time is verifying masking on your own forms — which is the part worth doing carefully.

Minutes 0–5

Deploy

npx wrangler login, then bash deploy.sh: the script creates your R2 bucket and D1 database, applies the schema and ships the worker — idempotently, into your account.

Minutes 5–10

Prove it on the demo page

The demo page ships with the kit: consent gate, masking defaults, batched gzip transport. Click around, wait 5 seconds, open the viewer and watch yourself in the replay.

Minutes 10–30

Ship it to your real site

Paste the snippet into your pages, point it at your worker, run the locale masking checklist with dummy data — then lock the viewer behind Cloudflare Access and set your retention.

One price. No meter running.

Replay vendors bill per month or per replay. This kit is a one-time purchase — and the running infrastructure is your own free tier.

$69 one-time payment

≈ ฿2,380

Full pipeline: rrweb recorder, Worker ingest, R2 + D1, viewer
Masking presets TH/JA/ZH/KO/AR/DE with real DOM examples + test checklists
Click heatmap module + GDPR/retention playbook
One-command deploy to your own Cloudflare account
Free updates for v1.x · 30-day full refund

Secure checkout via Stripe · card payments · taxes calculated at checkout

Instant download · 30-day refund, no questions · human reply within a day · secure checkout by Stripe

Not sure yet? Try a free sample

Three real files from the kit, trimmed to taste: the masking-config module with 2 of the 6 locale presets (Thai, Japanese) and the working applyPreset() merge, the Thai preset doc with a real form DOM example and the 10-minute test checklist, and sections 1–3 of the GDPR playbook (roles, consent, the masking verification ritual). Instant download — no email needed.

Download the free sample (zip) Read what's inside first →

Frequently asked questions

Why not just use Microsoft Clarity? It's free.

If sending your users' clickstream to a cloud vendor is fine for your product, use it — free is a great price. This kit exists for the cases where that's not fine: GDPR-sensitive and EU-hosted products, health and finance, agencies whose client contracts forbid third-party clickstream, and teams who want raw recordings in storage they control. Different constraint, different tool.

Is this like OpenReplay?

OpenReplay proved demand for self-host replay (12.9k GitHub stars) but it's a full platform — VM, database, backend — with a managed tier at $199/mo (openreplay.com/pricing, 2026-09-20). This kit is deliberately light: rrweb + a Cloudflare Worker + R2 + D1, one command to deploy, roughly $0/month at indie scale. Lighter scope, and entirely yours.

What exactly do I get?

A 25-file zip: the Worker ingest code, a one-command deploy script, the D1 schema, a demo page with the canonical record snippet, the viewer with heatmap, six locale masking presets with DOM examples and test checklists, the GDPR/retention playbook, MANIFEST, a single-buyer license and five walkthrough screenshots. Every file is real code or documentation — the build gates fail on placeholders.

Do I need to be a Cloudflare expert?

No — you need an account and Node 18+. The deploy script creates the bucket and the database for you and re-runs safely if something fails midway. The actual install is reading SETUP.md's nine short chapters while the script does the API calls.

Can I trust the masking?

Trust it because you can verify it. maskAllInputs is on by default, masked content is never transmitted (so there is nothing to leak later), and every locale preset ships with a checklist: dummy data in, replay, confirm asterisks at three probe points. The honest caveat: rendered text outside inputs needs selectors, and no configuration replaces running that ritual after each redesign.

Smartlook is shutting down — does this help me migrate?

The Smartlook platform closes on 2027-09-30 (per the wind-down FAQ on smartlook.com after the Cisco/Splunk acquisition). If you were on it, this kit is a destination rather than another rented seat: your recordings land in your own bucket, on a free-tier stack, with an export path that is a folder of files you own.

What is the refund policy?

If the kit doesn't fit how you work, write to us within 30 days of purchase and we refund in full — the files are yours to keep or delete. One refund per purchase; we only ask for optional feedback.

Will there be a hosted version?

Not as this product. A hosted service would put us back in the data path — the exact property this kit exists to remove. The kit stays self-host; updates arrive as source files you re-deploy whenever you choose.

Session replay on your own Cloudflare account — masking on from the first line