Umami

Free: MIT licensed and free to self-host with no event cap, including funnels, retention, journeys, goals, revenue, attribution, segments, session replays and heatmaps (self-hosted heatmap recording landed in v3.2.0). Umami Cloud Hobby is $0/month: up to 100K events per month, 1 website, 6 months of data retention, community support.

Self-hosted: Docker Compose runs Umami plus PostgreSQL 12.14+ (MySQL support was removed in v3.0). Or build from source on Node.js 18.18+. First login is admin/umami, and the compose file ships a placeholder APP_SECRET, so change both. MCP is off by default (MCP_ENABLED=1). Email reports and the streaming API are Cloud-only. Patch promptly: CVE-2026-4317 (critical authenticated SQL injection, fixed 3.0.3), GHSA-3xx8-742v-m4mq (tracking cache token reusable as a share token, fixed 3.2.0), and v3.4.1 (2026-10-23) which pulls in a Next.js fix for a critical RCE.

Paid: Umami Cloud is billed monthly, cancel any time, with a 14-day trial. Pro is $20/month: 1 million events included, $0.00003 per additional event, up to 20 websites, up to 10 team members, 2-year retention, API and MCP access, email reports, email support. Business is $200/month: 10 million events included, $0.00002 per additional event, unlimited websites and members, 5-year retention, session replays (5,000 included, $0.005 per additional replay), heatmaps, white-labeling, streaming API, email and chat support. Enterprise is custom: SAML SSO, uptime SLA, custom retention, invoice billing, audit log. Each pageview counts as one event, and each saved event property counts as one more.