> ## Documentation Index
> Fetch the complete documentation index at: https://docs.datalyr.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Session replay privacy and masking
> What session replay masks by default, how to mask or reveal parts of a page, which consent signals stop recording, and what to tell your visitors.
When you finish, you know what a recording shows, how to change it on your own pages,
and what to add to your privacy policy.
## What is masked by default
| Content | Default |
| ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------ |
| Text on the page | Readable, except inside an element marked `data-dl-mask`. |
| Input, textarea, and select values, including password and hidden fields | Masked, always |
| Text in the `alt`, `title`, `placeholder`, and `aria-label` attributes | Readable. Use `data-dl-block` on an element whose attributes can hold personal data. |
| Page URLs | Stored without the query string or fragment |
| URLs inside the page, such as link `href` and image `src` | Recorded as written, including the query string |
| `track()` calls | Event name, value, currency, and product IDs only |
| Canvas, cross-origin iframes, and fonts | Not recorded |
Masking happens in the visitor's browser. Masked text never reaches Datalyr.
## Choose how much text is masked
The **Privacy** section of Replay settings, on the Replays page, sets the text mode for
replay and heatmaps together. New sessions use it on their next page load. Sessions
already recorded keep the masking they were recorded with.
| Mode | What a recording shows |
| --------------------- | ------------------------------------------------------------------------------------------------------------------- |
| Marked only (default) | All page text. Only elements you mark `data-dl-mask` are masked. |
| Standard | Text inside buttons, links, labels, `summary` elements, and `[role=button]` elements. Everything else shows as `*`. |
| Strict | Only elements you mark `data-dl-unmask`. Button, link, and label text is masked too. |
Input values are masked in every mode. Pick Standard or Strict when a page can show a
visitor's own data in places you can't mark, such as a signed-in account area.
## Change masking on your pages
Add one of these attributes to an HTML element. It applies to the element and everything
inside it.
| Attribute | Effect |
| ---------------- | ------------------------------------------------------------------------------------- |
| `data-dl-mask` | Masks the text, including button, link, and label text |
| `data-dl-unmask` | Shows the text. Input values stay masked. |
| `data-dl-block` | Removes the element from the recording. Playback shows an empty box of the same size. |
```html theme={null}
Subtotal £42.00
...
```
`data-dl-mask` wins over `data-dl-unmask` when both apply to the same text.
`data-dl-unmask` shows the text inside it to anyone in your workspace. Don't put it on
an element that can hold a name, an email address, an address, or an order number.
## Turn off replay on one site
If one site shares a workspace but must never be recorded, pass `replay: false` to
`init()`. It keeps replay off on that site, whatever the dashboard says.
```js theme={null}
datalyr.init({ workspaceId: 'YOUR_WORKSPACE_ID', replay: false })
```
`init()` can only turn replay off. Only the dashboard turns it on.
## Signals that stop recording
The recorder starts only when every row below allows it. If a signal changes during a
visit, recording stops and unsent data is discarded.
| Signal | Effect on replay |
| ------------------------------------------------------------ | ----------------------------------------------------------------- |
| `optOut()` | Stops recording |
| `setConsent()` with `analytics: false` or `marketing: false` | Stops recording |
| Shopify Customer Privacy: analytics or marketing declined | Stops recording |
| Do Not Track | Stops recording, even if `respectDoNotTrack` is `false` |
| Global Privacy Control | Stops recording, even if `respectGlobalPrivacyControl` is `false` |
| `privacyMode: 'strict'` | Stops recording |
| Health or wellness workspace | Session replay can't be turned on |
See [Privacy and redaction](/advanced/privacy) for how each signal affects tracking in
general.
## Shopify checkout
Shopify checkout pages are never recorded. Shopify runs checkout in a sandbox that no
storefront script can see into. A recording ends when the visitor starts checkout, so
payment and address fields never appear in a replay.
## Add a line to your privacy policy
Session replay records how visitors use your site. Tell them. You can adapt this
sentence:
> We use Datalyr to record how visitors interact with our website, such as clicks,
> scrolling, and the pages they view, so we can find and fix problems. Text you type is
> always masked before it leaves your browser, and other page text is masked according to
> our settings. Recordings are kept for 30 days. We don't record visitors who decline analytics or marketing cookies, or whose
> browser sends Do Not Track or Global Privacy Control.
If you use Heatmaps without Session replay, use this sentence instead:
> We use Datalyr to measure where visitors click and how far they scroll on our website,
> so we can find and fix problems. Text you type is always masked before it leaves your
> browser, other page text is masked according to our settings, and no recordings are
> made. Click and scroll data is kept for 90 days. We don't measure visitors who decline analytics or marketing cookies,
> or whose browser sends Do Not Track or Global Privacy Control.
Both sentences are a starting point, not legal advice. Check them with your own adviser
before you publish them.
## What to tell visitors who ask
| Question | Answer |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| Can you see what I typed? | No. Every form value is masked in the browser. |
| Can you see my card details? | No. On Shopify, checkout is never recorded. |
| How do I stop it? | Decline analytics or marketing cookies, or turn on Global Privacy Control in the browser. |
| How long do you keep it? | Recordings: 30 days. Written summaries: 2 years. Heatmap data: 90 days. |
| Can you delete my recording? | Recordings expire after 30 days. For an earlier deletion, contact [support@datalyr.com](mailto:support@datalyr.com) with the visitor's `distinct id`. |
## Verify
1. Turn on session replay. See [Session replay](/product/session-replay).
2. Visit a page that holds a form.
3. Type into a field.
4. Wait about 35 minutes.
5. Open the session on **Replays**.
6. Confirm the field value shows as `*` characters.
7. Confirm any element you marked `data-dl-block` shows as an empty box.
## When it does not work
| Symptom | Cause | Fix |
| ------------------------ | ---------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- |
| Text you need is masked | The text mode is Standard or Strict, or the element is under `data-dl-mask`. | Switch the mode in Replay settings, or add `data-dl-unmask` to the element. |
| Private text is readable | The text mode is Marked only and the element is not marked, or it sits under `data-dl-unmask`. | Add `data-dl-mask` to the element, or switch to Standard. |
| A widget still shows | The attribute is on a parent the widget renders outside of. | Put `data-dl-block` on the widget's own root element. |
## Next
* [Session replay](/product/session-replay): pricing, retention, and asking the agent.
* [Privacy and redaction](/advanced/privacy): consent and opt-out for all tracking.