Heatmaps and session recordings without Microsoft or Google
Heatmaps show where visitors click and scroll, and session recordings replay what they did on a page. Both are useful for finding out why a form is abandoned or a button is missed, and both capture personal information about every visitor they record. The free tools most sites reach for are run by large advertising companies under their own terms. You can run the same kind of analysis yourself, on your own server, with open-source software such as Matomo or OpenReplay, or measure your site with Plausible, which records no personal data at all. This article compares the options and sets out what South Africa's Protection of Personal Information Act (POPIA) asks of you.
What the free tools' terms say
Microsoft Clarity and Google Analytics are free, and their terms are worth reading before you add them to a site.
- Microsoft Clarity's terms of use say Microsoft may use the personal data it collects through Clarity for any purpose in line with its privacy statement, including improving its products and creating user profiles for purposes that include advertising. They also tell site owners not to use Clarity on content that may include sensitive material such as health, financial services or government information.
- Google Analytics has data sharing settings, chosen at sign-up and changeable under Admin > Account details. With the "Google products and services" setting on, Google may analyse your data to improve its own products. With all the sharing settings off, Google says it uses the data only to provide and maintain the service.
Whether those terms suit your visitors is your decision, and under POPIA, your responsibility.
What a recording captures
A heatmap counts clicks and scrolls across many visitors. A session recording replays one visitor's visit: the pages they opened, where they moved the mouse, what they clicked and, unless masked, what they typed.
Under POPIA, personal information includes online identifiers and a person's views and preferences, and it covers anything that identifies a visitor, such as a name typed into a form or an account page they viewed. Matomo itself warns that recordings may not be fully anonymous, because they can reveal personal data through what is visible on the page, the addresses visited, the visitor's behaviour or the surrounding context.
The self-hosted options
| Tool | Licence | Heatmaps and recordings | Best for |
|---|---|---|---|
| Matomo | GNU GPL v3 or later | Yes, through a paid Heatmap & Session Recording plugin | Full analytics, with heatmaps and recordings when you need them |
| OpenReplay | GNU AGPL v3 for most of the code | Session replay | Dedicated session replay on your own server |
| Plausible Community Edition | GNU AGPL v3 | None in its feature list | Simple, cookie-free visitor statistics |
Matomo
Matomo is a full web analytics platform, free and open source, that you run on your own hosting. Heatmaps and session recordings come from a separate premium plugin, sold by Matomo's makers under their own licence. The plugin records clicks, mouse movement, scrolling, form interactions and page changes. Matomo masks data in the visitor's browser before anything is sent: keystroke recording is off by default, password and card fields are always masked, and any part of a page can be hidden from recordings with a single attribute.
OpenReplay
OpenReplay is a self-hosted session replay tool, with most of its code under the AGPL. It can be deployed with Docker on an Ubuntu server, among other routes. Data you mark as obscured is never captured: OpenReplay says it does not leave the visitor's browser. Email addresses in text and inputs are obscured by default, and other content can be masked with an attribute.
Plausible
Plausible Community Edition is the free, self-hosted release of Plausible Analytics. It counts visitors, pages, sources and goals without cookies and, in its own words, without collecting personal data. It offers no heatmaps or recordings, and that is its strength: for many sites, knowing which pages work is enough, and Plausible gives that with nothing personal to protect.
Set up recordings with privacy first
Whichever tool you choose:
- Ask whether you need recordings at all. Aggregate statistics answer most questions.
- Mask by default. Hide every input and any text that could identify someone, and unmask only what you need.
- Never record checkout, login or account pages.
- Record a sample, not every visitor, and only for as long as the question takes to answer.
- Keep retention short, and delete recordings once they have served their purpose.
- Start recording only after consent. Matomo recommends this, and it is the simplest lawful ground for recordings.
What POPIA asks
- A lawful ground. POPIA requires consent or another ground in section 11, such as a legitimate interest. For recordings, consent is the safest: voluntary, specific and informed, provable by you, and withdrawable at any time.
- Minimality. Section 10 allows only information that is adequate, relevant and not excessive for the purpose, which is the legal case for masking by default.
- A notice. Section 18 requires you to tell visitors what you collect and why, who receives it, and whether it leaves the country. Name the tool in your privacy notice.
- Data kept at home where possible. If the tool's provider holds the data outside South Africa, section 72's rules on transfers abroad apply. A tool on your own server in South Africa avoids that question.
Running them with Noiz
Plausible, Matomo and OpenReplay all run on a Noiz Cloud server, a self-managed Ubuntu or Debian server with full root access. Matomo, a PHP application, can also run on a Premium shared hosting plan for a smaller site's statistics.
If you would rather have analytics installed, configured with masking and consent, and kept up to date for you, get in touch and we will scope it with you. Our knowledgebase guide on WordPress cookies and consent covers the consent side on a WordPress site.
Sources
Checked 19 October 2026.
Self-hosted tools
- Matomo licences, Heatmap & Session Recording plugin, data masking FAQ and session replay and consent
- OpenReplay licence, deployment and sanitising data
- Plausible Community Edition
Microsoft and Google
The law
- Protection of Personal Information Act 4 of 2013: sections 1, 10, 11, 18 and 72
Noiz
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
