Privacy: RUM and session replay

Embed
Preview of the card
<a href="https://forumulate.com/p/watchtower/docs/privacy"><img src="https://forumulate.com/api/public/orgs/watchtower/spaces/docs/pages/5738f394-13c6-470f-b85d-970912aec38b/social-card.svg?v=3e7ae33eec8b" alt="Privacy: RUM and session replay" width="600" height="315"></a>

What is collected

  • RUM: page views, Core Web Vitals, errors (message, stack frames, debug ids), clicks and frustration signals (selector path only, no element text), route templates, release, coarse device class, browser and OS, country (from an operator GeoIP header or file), a salted hash of the user id.

  • Replay: DOM snapshots and mutations, pointer and scroll events, console and network metadata, recorded in the browser at the project's mask level (default strict: all text and inputs masked).

  • Profiles: stack samples. Command-line arguments are stripped by the scrub policy.

What is never collected

  • Password, card number and one-time-code inputs: never recorded, and removed again at wt-edge.

  • Element text in frustration events, request or response bodies, cookies and Authorization headers.

  • Routes listed in excluded_routes (for example /admin*): no events and no URL appear in any chunk.

  • Raw user ids: only a salted hash leaves the browser.

Defaults and floor

  • Replay is off until a project admin turns it on. The default mask level is strict.

  • Each project has a mask-level floor. A request below the floor is refused (the edge returns 422). Lowering masking (for example to relaxed) needs ManagePrivacy (ProjectAdmin); an Engineer's attempt returns 403.

  • Origins must be on the publishable key's allowlist; other origins get 403 for RUM, replay and OTLP.

  • Privacy changes are audited without the values of any secret.

Deletion

  • Turning replay off makes the next chunk request return 403 replay_disabled.

  • DELETE /v1/projects/{p}/replays/{session} removes the S3 prefix replay/{project}/{session}/ and then the metadata. Bulk delete by cutoff and legal holds are in replay-operations.md.

  • Retention is per project; a daily job removes expired objects and orphans.

Known limits

Server-side replay scrubbing covers password and card/OTP inputs by structure. A custom component that renders a secret as plain text is protected only by client masking (strict, the default) and block selectors. Add a block selector for such components.

Updated