Privacy controls

The defaults are the strict ones. Everything below is for going further, not for catching up.

What you get without configuring anything

Form fields masked in the browser: text inputs, text areas and dropdowns, and hidden and file inputs too. Each character becomes an asterisk, so a replay shows how long a value was, never the value. Passwords are masked the same way. Which checkbox or radio button is ticked is still recorded: to keep a sensitive one out, put it inside an element with data-sr-block.
Rich-text editors are not form fields. Text typed into a contenteditable box (a review or comment editor, say) is page text, and it is recorded unless the editor has class="sr-mask": see rich-text editors below.
Checkout never recorded — the recorder stops when a visitor reaches Shopify's checkout, or any page whose path has a /checkout or /checkouts segment, such as /checkout, /en/checkout/payment or /checkouts/…. A checkout at another address (for example /order or /payment) is not detected, so leave the snippet off that page.
Tokens, secrets, emails and search terms stripped from URLs, in the browser and again on our side.
Global Privacy Control honoured.
No cookies. No persistent identifier. Session state is scoped to one browser tab.
IP addresses never stored — country only.

Blocking an element entirely

A blocked subtree is not serialized at all. It is not masked and not present in the recording — the replay shows an empty box where it was.

<div data-sr-block>
  <!-- customer address, order list, anything sensitive -->
</div>

<!-- or by class -->
<div class="sr-block">…</div>

Use this for anything showing another person's data, and for heavy third-party widgets like chat bubbles — blocking them also makes recording cheaper, because serializing their mutations happens on the main thread.

Masking text

Masked text is replaced character-by-character, so layout and line breaks survive but the words do not.

<p class="sr-mask">Order #10482 for Priya Sharma</p>

Rich-text editors

The recorder masks form fields on its own, but a rich-text editor is a contenteditable element, not a form field: what a visitor types into it is page text, and page text is recorded. Put sr-mask on the editor itself, and everything typed into it is masked as it is typed:

<div contenteditable="true" class="sr-mask"></div>

Most editors (Quill, TinyMCE, CKEditor, ProseMirror, Lexical) let you add a class to the editable element. If one does not, put sr-mask on an element that wraps it: masking covers everything inside.

To mask all text on a site, turn on "Mask all text" in the site's settings rather than annotating every element — then replace the snippet on your site, as described below.

Ignoring an input's interactions

<input class="sr-ignore" name="coupon">

Note the limit honestly: sr-ignore is read by the input observer, not by the initial page snapshot. It stops interaction events being recorded; it is not a substitute for data-sr-block when the element's rendered value itself is sensitive.

Consent mode

EU regulators treat session replay as a tracker that is not strictly necessary, which means prior consent. In consent mode the recorder loads, does nothing, and buffers nothing until your banner allows it.

<script async src="…/t.js" data-key="pk_…" data-consent="required"></script>

<!-- from your CMP's "analytics accepted" callback -->
window.__sr.consent(true);

<!-- withdrawal: stops recording immediately -->
window.__sr.consent(false);

Settings changes need the new snippet

"Mask all text", consent mode and sampling are written into the snippet itself. Changing any of them in a site's settings does not change what your live site records until you replace the snippet on every page with the new one from the site's Install page in the dashboard. Until then, visitors keep being recorded under the old settings.

Deleting recordings

Any single recording can be deleted from its replay page. It goes from the database and from object storage immediately — not on a nightly job, and not by deleting the whole project.

There is no one-step "delete everything for this person" yet, and the dashboard has no filter by person. What an erasure request can reach depends on whether your site identifies its visitors:

If your site links sessions to your own user id with __sr.identify() (see the install guide), email support@appifycommerce.com with that user id and the site, and we find the recordings linked to it and delete them.
A visitor your site did not identify cannot be tied to a person: there are no cookies and no persistent identifier, so there is nothing to search by. You can still delete any recording you can pick out yourself, for example by the time and landing page of the visit.

Retention

Set per site, up to your plan's ceiling. Shortening it deletes older recordings on the next nightly purge. A storage-level expiry sits behind that as a backstop, so a failed job can delay a deletion but cannot keep a recording indefinitely.