Zenovay's session replay records DOM mutations, not pixels. That means we never capture screenshots of your visitors' screens. It also means the recorded DOM carries the text content of the page, so knowing what is masked by default, and what is not, is the whole job on this page.
What's masked by default
Without any configuration:
- Every
<input>,<textarea>, and<select>value is masked. The recorder captures the field but replaces its value with asterisks. This applies to all input types and is hardcoded, so there is no setting that turns it off. passwordfields and payment-card fields are blocked outright: their content is never captured, not even in masked form.- Canvas elements are not recorded at all.
So anything a visitor types into a form already stays out of the recording.
What is not masked by default
Text that your page renders is recorded as shown. A name on an account page, a shipping address in an order summary, an order number on a confirmation screen, an email in a support thread: if the page displays it as text rather than in an input, it is in the recording.
There are two ways to deal with that, and you will usually want both:
- Mask Text Content, a per-website toggle in Settings → Advanced, masks all rendered text. It is off by default. Switching it on is the blunt, safe option, at the cost of recordings that are much harder to read.
- The CSS hooks below mask or block the specific elements that carry personal data, and leave the rest of the page readable. This is the better default for most sites, as long as you actually go and mark the elements.
If your site displays personal data anywhere a visitor can reach, decide which of these you are using before you switch recording on.
Masking custom text
To mask the text content of any element (a customer ID, an order total, an internal note), add the class zenovay-mask-replay:
<div class="zenovay-mask-replay">
Customer #ABC-1234
</div>
The element still appears in the recording with its layout intact, but its text is replaced with masked characters before the recording leaves the browser. The real value never reaches Zenovay's servers.
Hiding an element entirely
If you want an element left out of the recording completely (not just masked) — for example an embedded card form or a section of a screen showing other people's data — block it. Add the class zenovay-block-replay, or the attribute data-private:
<div class="zenovay-block-replay">
<!-- replaced with an empty placeholder of the same size -->
</div>
<div data-private>
<!-- also blocked from the recording -->
</div>
A blocked element shows up in the player as an empty placeholder of the same dimensions, so the layout stays recognizable while the content is gone.
Ignoring input events
To keep an input visible in the recording but stop the recorder from capturing what the user does inside it, add zenovay-ignore-replay:
<input class="zenovay-ignore-replay" name="ssn" />
The field renders in the recording, but the keystrokes and value changes are ignored.
Excluding a whole page
There's no page-level "off" attribute. If you don't want replay to run on a page at all (a high-privacy admin screen, an internal-only page), turn session replay off for that domain, or block the page's main container with zenovay-block-replay. Pageviews and events are still tracked either way.
How to verify
Open a fresh recording from your website's dashboard — go to Audience → Sessions — and scrub to a frame that contains a masked or blocked area. Masked text should appear as asterisks; blocked elements should appear as empty placeholders. If you still see a real value, double-check that the class or attribute is on the element before the user interacts with it, not added afterwards.