Privacy
Last updated 6 October 2026
Who is responsible
A website that installs Replaycat decides what is recorded on it and who sees it. For its visitors' data, that website is in charge and Replaycat processes the data on its behalf. For the accounts of our own customers, Replaycat is in charge.
What Replaycat records
When a website installs our snippet, we record how visitors use it: the page as they saw it (as a reconstruction of the page, not a video), mouse movement, clicks, scrolling and navigation. With each visit we also keep:
- The page addresses and titles, and the address the visitor came from.
- Screen size, device, browser and operating system.
- Approximate location: country, city and the city's coordinates, worked out from the connection by our hosting provider.
- The visitor's IP address, so the website can block an address from being recorded. It is deleted with the recording.
- Messages the page writes to the browser console, the paths of network requests it makes (never the values in their query strings), and JavaScript errors.
- The text on a clicked button or link, only when the replay shows that text too.
- Events and details the website sends us itself, for example a name or email for a signed-in customer through
rc('identify'). Our WordPress plugin does this for signed-in WordPress users.
What is hidden before it leaves the browser
Text typed into any form field is masked in the visitor's browser on every level, so we never receive it. Each website picks how much of the rest is hidden:
| Level | Page text | Images and video | Typed input |
|---|---|---|---|
| Relaxed | Shown | Shown | Hidden |
| Balanced (default) | Shown | Hidden | Hidden |
| Strict | Hidden | Hidden | Hidden |
On every level, anything marked data-rc-mask or data-rc-block, or matched by the website's own rules, is hidden too. Strict also hides console messages and the paths of network requests. Page titles and error messages are kept on every level, so a page that shows personal details in either should use Strict or mark them. Credential-looking parts of addresses, such as tokens and passwords in query strings, are removed on every level.
What we store in the visitor's browser
No cookies. The tracker keeps these in the browser's own storage for the website's address:
| Name | What it is | How long |
|---|---|---|
| rc_vid | A random visitor id, so return visits count as one person | Until the visitor clears their browser storage, or the site calls rc('reset') |
| rc_sid and three small counters | The current visit, and when the visitor last did something | Until the tab closes; a new visit starts after 30 minutes idle |
| rc_pending | Up to three recording batches that could not be sent yet | Until they are sent or the tab closes |
| rc_cfg | The site's masking settings, so a visit can start before we answer | Updated on every visit; holds nothing about the visitor |
| rc_blocked | That the site has blocked this visitor | Until the site unblocks them |
| rc_chat_token, rc_chat_state | The visitor's chat, and its last 40 messages, so it survives a reload | Only once the visitor uses the chat; until the conversation is closed |
| rc_chat_asked, rc_chat_nudged | That the chat's intro form or a nudge was already shown, so it is not shown again | Until cleared; the nudge one until the tab closes |
Consent
A website can wait for its cookie banner. When it does, nothing is stored in the visitor's browser, nothing is recorded, and no visitor id is sent until the visitor agrees. The chat still works before then, without linking to the visitor. Visitors whose browser blocks the script are not recorded.
Who can watch a recording
The website's own team. An owner of the website can also make a share link to one recording, which anyone holding it can watch for 7 days, or until the owner stops sharing. A shared recording leaves out the chat transcript and any details the website sent through rc('identify').
Chat
When a website turns chat on, visitors can send messages from a bubble on the site. We store what is written on both sides, and the name or email a visitor chooses to give. A team can have new messages emailed to them, and a visitor who left an email can get replies by email. An agent's profile picture is loaded from the address the agent chose.
Retention and deletion
Recordings are deleted automatically after the plan's retention period: Free 7 days, Starter 30 days, Growth 90 days, Scale 180 days. When a website moves to a plan that keeps fewer days, the older recordings are locked for 30 days rather than deleted, so an upgrade can bring them back; after that they are deleted, and never later than the old plan would have kept them.
A chat is deleted once its last message is older than the retention period. An owner can delete a recording, a visitor with everything recorded about them, or a whole site, at any time, and it is gone at once. When a team member who is not an owner deletes a recording, it is hidden straight away and removed at the end of the retention period. Expired share links and logins are cleared nightly, and an account that never confirmed its email and never installed the snippet is deleted after 30 days.
Where data goes
We do not sell data. We use these providers to run the service, and nobody else:
| Provider | What for | Where |
|---|---|---|
| Vercel | Hosting for replaycat.com and the recording endpoint. Works out a visitor's approximate location from the connection. | United States |
| Supabase | The database that holds recordings, chats and accounts. | United States (us-east-1) |
| Cloudflare | DNS and network for replaycat.com, and the bot check on sign-up and password reset. | Global network |
| Anthropic | AI summaries and help-article drafts, only when a team asks for one. Receives a text digest of the visit or chats, not the recording. | United States |
| Resend | Email: account emails, and chat and alert emails a team turns on, which can contain a visitor's name and messages. | United States |
| Stripe | Payments for Replaycat customers. | United States |
| Sign-in, for customers who choose it. | United States | |
| Slack | Alerts, only for teams that connect it. | United States |
| Sentry | Error reports from the Replaycat dashboard, with emails and link tokens removed. Never from the tracker on your site. | United States |
| Have I Been Pwned | Checks a new password against known leaks. Receives only the first 5 characters of a hash of it. | Global network |
Connections between browsers and Replaycat are encrypted with TLS.
Your rights as a visitor
If you believe a website recorded you and you want to see or remove that data, contact the website first; it is in charge of it. If you cannot reach them, email us at [email protected] with the website address and roughly when you visited, and we will help.
Account data
For Replaycat customers we store your email, a hashed password (or your Google account id if you sign in with Google), the display name and picture you set, your teams and roles, and your billing status. Payments are handled by Stripe; we never see your card number. Signing in sets a cookie that keeps you logged in for 30 days while you use Replaycat, and one that remembers which team you last chose; we do not store your IP address or device with them. To delete your account, email [email protected] and we will remove it and its data within 30 days.