What is and isn't recorded
Session replay has a deserved reputation for capturing more than anyone intended. Here is exactly where our lines are, and where they are drawn — most of them in the visitor's browser, before anything is sent.
Masked in the browser
- What anyone types into a form field. Input, text area and dropdown values, hidden and file inputs included, are masked by the recorder itself: each character is replaced with one asterisk before anything is sent, so a replay shows how long a value was, never the value. A password is not stored encrypted or redacted later: its characters never leave the page. There is no "unmask" button anywhere in this product, because there is nothing to unmask.
- Two things it does not mask. Which checkbox or radio button is ticked is recorded, with the option's own value, so put a question whose answer is sensitive inside an element with
data-sr-block. And a rich-text editor (a contenteditable review or comment box) is page text, not a form field, so give itclass="sr-mask"(below).
Never captured at all
- Checkout pages. Recording stops the moment a visitor reaches Shopify's checkout, or any page whose path has a
/checkoutor/checkoutssegment, such as/en/checkout/payment. A checkout at another address is not detected, so leave the snippet off it. This also keeps our script out of scope for the parts of PCI DSS that govern payment pages. - IP addresses. We derive the country at the edge and store that. The address itself is never written down.
- Anything inside an element you mark. Add
data-sr-blockand the subtree is not serialized at all — not masked, not present. Addclass="sr-mask"to mask its text instead.
Stripped before storage
URLs routinely carry things they shouldn't: magic-link tokens, reset codes, email addresses, and whatever a merchant typed into a search box. Those parameters are replaced with *** in the browser, and again on our side when the data arrives — because the recording endpoint is public by design, and client-side redaction alone can be bypassed.
The redaction covers the URL in the address bar and the URLs the recorder writes into the page's own links, images and stylesheets. That second half is not obvious and we learned it the hard way: a page's full address ends up inside the href of its own skip-to-content link, which is how a live authentication token first reached our storage. It is fixed, and the fix is tested against the exact shape that caused it.
Not tracked across visits
No cookie is set. The session identifier lives in sessionStorage, scoped to one tab, and dies with it. The same person visiting twice is two unrelated sessions, and we have no way to tell they were the same person unless you explicitly tell us — and even then, the identifier you send is hashed in the browser before it is transmitted.
Consent and opt-out
Global Privacy Control is honoured by default: a visitor whose browser signals it is not recorded, and you do not have to configure anything. For sites that need prior consent — which EU regulators expect for session replay — turn on consent mode and nothing at all is buffered until your cookie banner calls window.__sr.consent(true).
What we do with it
We store it, we show it to the people you invite, and we delete it when its retention window ends or when you ask. It is not sold, not used to train models, and not fed to an advertising platform. That last point is not boilerplate: the best-known free tool in this category is operated by an advertising company that takes the role of an independent controller over the data it collects from your visitors.
You can delete any single recording, and it is gone from the database and from object storage immediately — without touching any other recording.
See it on your own store
Install the snippet on the free plan and open a replay of your own visit: the inputs you typed show as masked, and nothing from checkout is there.