PostHog

What it is

PostHog is a set of tools for understanding how people use your app. The parts a solo builder is most likely to use:

• Product and web analytics: which pages people visit, which buttons they click, and where they drop out of a sign-up flow.
• Session replay: a video-like playback of a real visit, so you can watch where someone got confused.
• Feature flags: switches in your code that turn a feature on for some users and off for others, so you can release gradually or test two versions.
• Error tracking: a list of the errors your users hit, linked to the replay of what they were doing.

There's much more (surveys, a data warehouse, AI cost tracking, logs, an AI assistant), and the repo is huge. Most people use the hosted cloud version. The code is MIT-licensed except an ee/ folder of paid features under a commercial licence, and there's a separate copy with that folder removed for anyone who needs fully open source. There are no version numbers for the main product: changes ship continuously.

What actually happens when you use it

1. Sign up and pick a region. Choose the EU cloud (servers in Frankfurt) or the US cloud. This matters for privacy, as covered below.
2. Run the wizard. npx @posthog/wizard@latest uses AI to find your framework and add PostHog's code to your app.
3. Data starts flowing. By default it captures page views and clicks automatically. Session replay records visits, with text typed into form fields hidden by default but other text on the page visible.
4. Identify logged-in users. When someone signs in, your code tells PostHog who they are, so you can follow one person across visits. Events tied to a known person are billed at a higher rate (see below).
5. Ask questions. Build charts yourself, use the built-in AI chat, or connect the MCP server so Claude Code or Cursor can query your data, create feature flags, build dashboards and look at errors from your editor.

What people like

• Agents can do the setup and the analysis. On r/posthog, a non-developer asking for a beginner's guide was told by several users to just install the MCP, which one called one of the most capable they'd found. Another said it works really well for vibe-coded projects.
• The setup wizard mostly works. One user said it worked like a dream on their Astro project, though another had problems with it and just asked Claude instead. A developer who set it up on three apps found the MCP and AI chat helpful for checking the integration and building dashboards.
• The built-in AI is useful to some. Users say it does a good job of slicing data and building dashboards, work that's otherwise tedious.
• It's cheap or free when small. One user called it basically free for startups, though in the same breath called the product a mess. Pricing is public and there's no per-seat charge, which a UX designer said earns their trust.

What people run into

• The interface is hard to learn. A January thread from a new user who spent three hours and still didn't know where anything was drew many agreeing replies. One team saw low adoption among non-technical colleagues. Some longtime users say the push to add AI everywhere has made it harder to find the basics.
• Your data trains PostHog's AI unless you opt out. In May, PostHog announced that customers on the US cloud are opted in by default to having their anonymized data used to train its own models, starting with session replays. EU cloud customers are opted out by default. PostHog says it won't sell the data or send it to outside AI companies. Some developers on Hacker News said they were pulling PostHog from their projects over it.
• Its npm packages were hijacked once. In November 2025, attackers published malicious versions of posthog-js, posthog-node and others that stole credentials from any machine that installed them. They were removed within about five hours. Sites loading PostHog from its script tag weren't affected.
• It can slow your app. One developer turned it off because it was collecting so much it made their app unusably slow. Another replied that loading it after the page appears usually fixes this.
• Numbers don't match other tools. Users comparing it with Google Analytics see visitors in one but not the other. Replies suggest sending PostHog through your own domain (a reverse proxy) so fewer visits get blocked, but say exact parity isn't possible.
• You can't easily clean up bad data. A request to delete individual events has been open since 2023 and is still collecting votes this month.
• Self-hosting is much harder than the one-line script suggests. PostHog's own docs say it needs a server with 4 CPUs and 16GB of RAM, comes with no support, keeps paid features cloud-only, and is unlikely to scale past a few hundred thousand events without serious work. Developers who tried in 2026 say the install broke after changes made for the cloud, or they gave up after a day, though one said it works fine for them. A security researcher also chained bugs and static default database passwords into taking over a self-hosted server, in a write-up published last December.

Before you install

• Know the free tier and what comes after. From the pricing page today, no card is needed and each month includes 1 million analytics events, 5,000 session recordings, 1 million feature flag requests, 1,500 survey responses and 100,000 errors, with 1 project and 1 year of data. Adding a card keeps those allowances, then charges per unit, and gives you 6 projects and 7 years of data. By my maths from that page, 3 million events a month costs about $84 if they're anonymous, or about $352 if they're all tied to logged-in users, because identified events carry an extra charge.
• Set a billing limit on every product. You set a dollar cap per product and get emails at 80% and 100%. Past the cap, PostHog stops collecting and that data is lost for good, which is usually better than a surprise bill.
• Pick the EU cloud if your users are in Europe. It turns off IP address collection by default and opts you out of AI training. On the US cloud, decide about AI training in your organization settings.
• Consent is your responsibility. PostHog collects data automatically, and its GDPR guide says you must get clear consent and stop all tracking when someone opts out. Ask your agent to either start everyone opted out until they accept a cookie banner, or use cookieless mode for anonymous counting without a banner.
• Hide personal data in replays. Form inputs are masked, but names, emails and addresses shown as page text are recorded unless you mask them.
• Limit what the MCP server can do. It can create and change things, not just read. You can restrict it to certain tool groups in the connection URL, and keep approving tool calls by hand.
• Protect your installs. After the npm attack, PostHog itself recommends a minimum release age in pnpm or yarn, so brand-new package versions wait a few days before you install them.
• Use the cloud. Self-host only if running servers is something you already do well.

The short version

PostHog gives a solo builder analytics, replays, flags and error tracking for free until real traffic arrives, and it's one of the friendliest tools to hand to a coding agent. The trade-offs are an interface many find confusing, privacy work you can't skip, and a default on the US cloud that feeds your data into PostHog's AI training. Start on the cloud, set billing limits and consent on day one, and ignore the self-hosting option.