Privacy

What Replaycat records

When a website owner installs our snippet, we record how visitors use that website: page structure, mouse movement, scrolling, clicks, and navigation. This is a reconstruction of the page, not a video or screenshot. Only the website owner can watch it.

What we never record

• Text typed into any input field. Every input is masked in the visitor's browser before anything is sent. Passwords, card numbers, and messages never leave the page.
• IP addresses. We read the country from the request and discard the address.
• Anything the website owner marks with data-rc-mask or data-rc-block.
• Cookies from other sites, browser history, or anything outside the page being viewed.

Consent

Website owners can gate recording behind their consent banner. When they do, nothing is recorded until the visitor agrees. Visitors with Do Not Track or a blocked script are simply not recorded.

Retention

Recordings are deleted automatically after the plan's retention period: Free 7 days, Starter 30 days, Growth 90 days, Scale 180 days. Website owners can delete any session, or an entire site with all its sessions, at any time. Deletion is immediate and permanent.

Where data lives

Recordings are stored in a Postgres database hosted in the United States (us-east-1). Data in transit is encrypted with TLS. We do not sell or share recordings with anyone.

Your rights as a visitor

If you believe a website recorded you and you want that recording removed, contact the website owner first; they control the data. If you cannot reach them, email us at privacy@replaycat.com with the website address and approximate time of your visit and we will help.

Account data

For Replaycat customers we store your email, a hashed password, and your billing status. Payments are handled by Stripe; we never see your card number. Delete your account by emailing us and everything is removed within 7 days.