Masking and consent

Masked by default. Every <input>, <textarea>, and <select> is masked in the visitor's browser before anything is sent. We never receive passwords, card numbers, or typed messages. The address a visit came from is kept with the recording, shown to your team so an abusive visitor can be blocked, and deleted with it.

Stripped on your behalf. Some things are removed whatever your settings, and twice: in the visitor's browser before a batch is sent, and again on our servers before anything is stored. Query parameters that look like credentials (tokens, passwords, API keys, OAuth codes, CSRF fields), JWTs wherever they appear, Stripe secret and restricted keys, AWS access key ids, GitHub and Slack tokens, and long random ids in page paths. A session id in a URL never reaches us, even from a page that puts it there.

Mask text. Add data-rc-mask to any element and its text is replaced with asterisks:

<span data-rc-mask>Balance: $12,345.00</span>

Block entirely. Add data-rc-block and the element is recorded as an empty box of the same size. Use it for embedded chats, video, or anything third-party.

Consent gate. If you need opt-in before recording, add data-consent="true" to the script tag (or &consent=true on the URL form). Nothing is recorded until you call:

rc("consent");

Wire that to the accept button of your cookie banner. Visitors who decline are never recorded.

Stop recording. rc("stop") ends recording for the rest of the page view.