# Privacy
A recording shows what a person saw. The defaults are chosen so that a forgotten setting records less, not more.
## What is recorded
- The page's DOM when it loads and every change to it afterwards, the stylesheets, mouse movement, clicks, scrolling, viewport size and input events.
- The markers described in [Recording](https://packstub.dev/docs/session-replay/recording#markers): errors, `console.error` output, failed Livewire requests, web vitals, rage clicks, page views.
- With the recording: who was signed in (morph type and key; nobody with `privacy.anonymous`), the workspace and impersonator if your app provides them, your own properties, the first URL, the user agent (unless `privacy.store_user_agent` is off) and a device class (`desktop`, `tablet`, `mobile`).
## What is not recorded
- **No IP address.** Not stored, not used for rate limiting.
- **Input values.** Every input, textarea and select is masked with asterisks, whatever its type (`privacy.mask_all_inputs`, default `true`); checkboxes and radio buttons keep their checked state. Password inputs, hidden inputs and the file name of a file input are masked even when that setting is off.
- **Rich editors.** Text in a `contenteditable` element (Tiptap, Trix, CodeMirror) is masked like an input, through the default `privacy.mask_text_selector`.
- **Hidden inputs.** The value of every `` (a CSRF token, an id, a signature) is dropped before upload, and one a script writes later (Livewire, Alpine) is masked.
- **Secrets in URLs.** The query parameters in `privacy.redact_query` (`token`, `signature`, `code`, `state`, `email` and others) keep their name and lose their value in every URL the recorder sends: the first page, page views, error messages and sources, stack traces, console messages, and the links, images (`srcset` included), videos and form actions in the page itself.
- **Password-reset and verification pages.** The default `except` list leaves out the pages whose URL carries such a link (`*password-reset*`, `*reset-password*`, `email/verify*` and the like), and `except_routes` the same pages by route name (`password.*`, `verification.*`, Filament's `filament.*.auth.password-reset.*`), whatever their URL.
- **Scripts.** Script contents are left out of the snapshot and the player never executes anything; it rebuilds the DOM in a sandboxed iframe.
- **Livewire component state.** `wire:snapshot` and `wire:effects` are dropped before upload, along with Alpine expressions (`size.strip_attributes`).
- **Guests**, unless you turn `guests` on.
- **Canvas contents and cross-origin iframes.**
- **Cookies, local storage, request or response bodies.**
Console output can contain data your own code logs; set `capture.console` to `[]` if that is a concern.
## Mask, block, ignore
Three attributes cover what the defaults cannot know about:
```blade
{{-- The text is replaced with asterisks; layout stays. --}}
IBAN {{ $account->iban }}
{{-- Recorded as an empty box of the same size. Children are never serialized. --}}
@include('billing.card-details')
{{-- The element is recorded, typing into it is not. --}}
```
`data-replay-mask` applies to the element and everything inside it. The selectors are configurable (`privacy.mask_text_selector`, `privacy.block_selector`, `privacy.ignore_selector`), so existing classes can be reused:
```php
'privacy' => [
'mask_text_selector' => '[data-replay-mask], [data-replay-mask] *, .pii, .pii *',
'block_selector' => '[data-replay-block], .card-form',
],
```
### Layout only
```php
'privacy' => ['mask_all_text' => true],
```
Every text node is replaced with asterisks, and so is text the page shows through attributes: `alt`, `title`, `aria-label`, `placeholder`, `download`, an option's `label`, the caption of an `` (also when a script changes it later) and the `content` of a `` tag. Page titles are left out of the `navigation` markers. The replay still shows where people click and what breaks, without a readable word. The same attributes are masked inside `privacy.mask_text_selector` (`data-replay-mask`), and a button whose caption holds masked text is named by its tag in rage-click markers.
To keep your own interface readable in this mode (menus, headings, column headers, button captions), mark it with `data-replay-unmask`:
```blade
```
Text inside stays as it is, except where `mask_text_selector` matches (`data-replay-mask` and rich editors stay masked inside it too); input values are never affected. The selector is `privacy.unmask_text_selector`. Without `mask_all_text` it does nothing.
## Consent
| `consent` | Behaviour |
| --- | --- |
| `always` (default) | Recording starts with the page. For a product used under a contract or terms that cover it. |
| `opt-in` | The recorder loads and waits. Nothing is recorded or uploaded until the person agrees. |
With `opt-in`, call the browser API from your consent banner:
```js
// The person agreed: remembered in localStorage, recording starts now.
SessionReplay.consent(true);
// The person declined or withdrew: remembered, recording stops, the buffer is dropped.
SessionReplay.consent(false);
```
`respect_gpc = true` leaves people alone whose browser sends the Global Privacy Control signal, in both modes.
## Asking before a replay is sent
With `mode = on_error` and `on_error.ask = true`, the recorder asks the person after something went wrong whether to send the replay of what just happened. Nothing is uploaded unless they agree.
- **Send** uploads the kept window, and the tab keeps recording for the rest of its session; the dialog says so.
- **Don't send** (or Escape) drops what was kept, and the tab is not recorded again until its session ends (`idle_timeout`, or a change of person or workspace). With `on_error.ask_again = true` the tab keeps a window instead and asks again on the next trigger, at most once per window (`buffer_seconds`), so a burst of errors asks once.
- **Anonymously.** When someone is signed in, a checkbox sends the replay without their name: the same rule as `privacy.anonymous`, for this recording only. No person and no impersonator are stored, the workspace and your properties stay, and the upload still counts against the person's daily allowance. The choice only ever removes identity from the signed token; the request carries nothing else about who someone is.
- **Nothing is kept before the answer.** Only a window the person agreed to send may wait in the browser's storage when its upload fails (`on_error.keep_pending`, see [below](#what-stays-in-the-browser)), and the anonymous choice is kept with it.
- **The dialog** is drawn by the recorder in plain DOM, inside a closed shadow root: your page's styles do not reach it, its styles do not leak into your page, and it never appears in a replay. It is a native modal `