Never captured at all

• What anyone types. Input values are masked by the recorder itself. A password is not stored encrypted or redacted later — it never leaves the page. There is no "unmask" button anywhere in this product, because there is nothing to unmask.
• Checkout pages. Recording stops the moment a visitor reaches a checkout URL. This also keeps our script out of scope for the parts of PCI DSS that govern payment pages.
• IP addresses. We derive the country at the edge and store that. The address itself is never written down.
• Anything inside an element you mark. Add data-sr-block and the subtree is not serialized at all — not masked, not present. Add class="sr-mask" to mask its text instead.

Stripped before storage

URLs routinely carry things they shouldn't: magic-link tokens, reset codes, email addresses, and whatever a merchant typed into a search box. Those parameters are replaced with *** in the browser, and again on our side when the data arrives — because the recording endpoint is public by design, and client-side redaction alone can be bypassed.

The redaction covers the URL in the address bar and the URLs the recorder writes into the page's own links, images and stylesheets. That second half is not obvious and we learned it the hard way: a page's full address ends up inside the href of its own skip-to-content link, which is how a live authentication token first reached our storage. It is fixed, and the fix is tested against the exact shape that caused it.

Not tracked across visits

No cookie is set. The session identifier lives in sessionStorage, scoped to one tab, and dies with it. The same person visiting twice is two unrelated sessions, and we have no way to tell they were the same person unless you explicitly tell us — and even then, the identifier you send is hashed in the browser before it is transmitted.

Consent and opt-out

Global Privacy Control is honoured by default: a visitor whose browser signals it is not recorded, and you do not have to configure anything. For sites that need prior consent — which EU regulators expect for session replay — turn on consent mode and nothing at all is buffered until your cookie banner calls window.__sr.consent(true).

What we do with it

We store it, we show it to the people you invite, and we delete it when its retention window ends or when you ask. It is not sold, not used to train models, and not fed to an advertising platform. That last point is not boilerplate: the best-known free tool in this category is operated by an advertising company that takes the role of an independent controller over the data it collects from your visitors.

You can delete any single recording, or every recording belonging to one visitor, and it is gone from the database and from object storage immediately.

Data processing addendum · Sub-processors · Security