Privacy controls

The defaults are the strict ones. Everything below is for going further, not for catching up.

What you get without configuring anything

Every input value masked, including hidden inputs. Passwords are never captured in any form.
Checkout URLs never recorded — the recorder stops when the visitor reaches one.
Tokens, secrets, emails and search terms stripped from URLs, in the browser and again on our side.
Global Privacy Control honoured.
No cookies. No persistent identifier. Session state is scoped to one browser tab.
IP addresses never stored — country only.

Blocking an element entirely

A blocked subtree is not serialized at all. It is not masked and not present in the recording — the replay shows an empty box where it was.

<div data-sr-block>
  <!-- customer address, order list, anything sensitive -->
</div>

<!-- or by class -->
<div class="sr-block">…</div>

Use this for anything showing another person's data, and for heavy third-party widgets like chat bubbles — blocking them also makes recording cheaper, because serializing their mutations happens on the main thread.

Masking text

Masked text is replaced character-by-character, so layout and line breaks survive but the words do not.

<p class="sr-mask">Order #10482 for Priya Sharma</p>

To mask all text on a site, turn on "Mask all text" in the site's settings rather than annotating every element.

Ignoring an input's interactions

<input class="sr-ignore" name="coupon">

Note the limit honestly: sr-ignore is read by the input observer, not by the initial page snapshot. It stops interaction events being recorded; it is not a substitute for data-sr-block when the element's rendered value itself is sensitive.

Consent mode

EU regulators treat session replay as a tracker that is not strictly necessary, which means prior consent. In consent mode the recorder loads, does nothing, and buffers nothing until your banner allows it.

<script async src="…/t.js" data-key="pk_…" data-consent="required"></script>

<!-- from your CMP's "analytics accepted" callback -->
window.__sr.consent(true);

<!-- withdrawal: stops recording immediately -->
window.__sr.consent(false);

Deleting a visitor's recordings

If someone exercises a right of erasure, open the site, filter to that visitor, and delete. Recordings go from the database and from object storage immediately — not on a nightly job, and not by deleting the whole project.

Retention

Set per site, up to your plan's ceiling. Shortening it deletes older recordings on the next nightly purge. There is also a storage-level expiry behind that as a backstop, so nothing can outlive its window because a job failed.