Session Storage & Privacy

Pro Plan

Learn how Zenovay handles session recordings, from what is masked by default to where recordings are stored and how long they are kept.

Privacy First Approach

Our Philosophy

Session Replay is designed with privacy in mind:

Every input value is masked by default, and this cannot be switched off
Password and payment-card fields are blocked from capture entirely
You control the rest of what's captured with simple CSS classes and URL exclusions
Recordings are not sold and not shared with advertisers. They are visible to your workspace and stored on the infrastructure providers listed below

What We Always Mask

Regardless of your settings, every input value is masked. The recorder is hardcoded to mask all inputs, textareas, and selects, so what a visitor types never leaves the page. There is no setting that turns this off.

Password and payment-card fields go further and are blocked from capture. When recording starts, Zenovay flags every password input (including fields tagged with autocomplete="password", current-password, or new-password) and every card-number field, and their content is not recorded at all.

Data Masking

Default Behavior

Input values are masked by default. Text that your page renders is not. Session Replay records the DOM, so anything the page displays as text, such as a customer name on an account page, a shipping address in an order summary, or an order number in a confirmation, appears in the recording as it appeared on screen.

That is what the Mask Text Content setting is for. It is off by default, and it is the single most important thing to review before you record pages that display personal data.

Element	Default treatment
`input[type="password"]`	Blocked from recording
Payment-card fields	Blocked from recording
`input[type="email"]`	Value masked
`input[type="tel"]`	Value masked
`input[type="text"]`, `textarea`, `select`	Value masked
Text rendered by the page	Recorded as shown, unless Mask Text Content is on
`.zenovay-mask-replay`	Text masked
`[data-private]`	Blocked from recording

To hide rendered text, either switch Mask Text Content on for the whole site in Settings → Advanced, or mark the specific elements with the CSS hooks below. Marking specific elements keeps the rest of the recording readable, which is usually the better trade.

What Masking Looks Like

In recordings, masked content shows as ••••••••. Blocked elements are removed from the recording entirely and never appear in playback.

Masking and Blocking with CSS Classes

Zenovay's recorder reads three CSS hooks. Add the appropriate class (or attribute) to any element on your site:

<!-- Mask the text (shown as ****) -->
<span class="zenovay-mask-replay">Personal info</span>

<!-- Block from recording entirely (not captured at all) -->
<div class="zenovay-block-replay">
  This section won't appear in recordings
</div>

<!-- The data-private attribute also blocks an element -->
<input type="text" data-private>

Hook	Effect
`zenovay-mask-replay` (class)	Text is masked, shown as `••••••••`
`zenovay-block-replay` (class)	Element is completely removed from the recording
`data-private` (attribute)	Element is blocked from the recording

These hooks work anywhere in your markup - on inputs, forms, or whole sections.

Recording Mode

Session Replay can run in two trigger modes, set per website:

Mode	Behavior
Errors only (default)	A share of sessions is buffered in the background and saved only when the visitor hits a JavaScript error, so you keep the recordings that matter. Zenovay sets the share from the server, typically 10% of sessions, or 25% for a brand-new site so you get data quickly
All sessions	Every session is recorded, with no sampling

To change the mode, open the website's dashboard, go to Settings → Advanced, enable Session Replay, then choose the recording mode. Recording stays off until you enable it.

Recording all sessions captures more data. Make sure your masking and exclusions are configured and that your privacy notice covers session recording before switching to "All sessions".

Blocking Recording

Block Entire Pages

You can stop recording on specific URL paths. In the website's dashboard, go to Settings → Exclusions and add the paths you want to exclude under Exclude URL paths, for example:

/admin/*
/account/settings
/checkout/payment

Sessions on excluded paths are skipped and never stored.

Block Elements

To remove a specific element from recordings, add the zenovay-block-replay class or the data-private attribute:

<!-- Don't record this element at all -->
<div class="zenovay-block-replay">
  This section won't appear in recordings
</div>

<!-- Same effect with the data-private attribute -->
<div data-private>
  Sensitive content here
</div>

Depending on your jurisdiction:

Region	Requirement
EU (GDPR)	Explicit consent often required
California (CCPA)	Opt-out must be available
Other	Varies by law

Recording is enabled from your website settings (Settings → Advanced), not via a JavaScript API. To stop all tracking (including recording) when a visitor withdraws consent, use the tracker's command queue:

// Disable tracking if consent withdrawn
if (!userConsented) {
  zenovay('disable');
}

// Re-enable tracking when consent is granted
if (userConsented) {
  zenovay('enable');
}

Works with any consent manager that can fire a callback, including OneTrust, Cookiebot, and CookieYes, or your own custom implementation.

// Wait for consent signal
window.addEventListener('consent-given', function() {
  zenovay('enable');
});

window.addEventListener('consent-withdrawn', function() {
  zenovay('disable');
});

Data Storage

Where Data Is Stored

Session data is:

Encrypted at rest
Hosted on Cloudflare's global edge infrastructure
Stored with the EU (Frankfurt) database as the primary region

Retention Periods

Plan	Retention
Free	Not available
Pro	60 days
Scale	120 days
Enterprise	180 days

After Retention

When retention expires:

Recordings are automatically deleted
They cannot be recovered

Data Security

Encryption

All session data is:

Encrypted in transit (TLS)
Encrypted at rest

Access Control

Recordings are only visible to members of your workspace, scoped by their role. Audit logging of who accessed what is available on the Scale plan.

Security & Compliance Posture

Zenovay is designed for GDPR readiness and runs on infrastructure from certified providers:

Cloudflare (SOC 2 Type II, ISO 27001, ISO 27018)
Supabase (SOC 2 Type II)
Stripe handles all payment data (PCI DSS Level 1)

For international data transfers, Zenovay relies on the EU-US Data Privacy Framework and Standard Contractual Clauses where applicable.

Legal Basis

For session recording under GDPR:

Basis	Notes
Consent	Explicit user consent
Legitimate Interest	With proper assessment

Data Subject Rights

Users can request:

Access to their recordings
Deletion of recordings
Export of their data

Implementing Rights

When you receive a request:

The user submits the request
Find the relevant sessions in your dashboard
Export or delete them
Confirm completion

Deleting Recordings

To remove a specific recording, open the website's Sessions view, find the session, and delete it. The recording and its stored events are permanently removed and cannot be recovered.

For a broader account-level deletion request, see GDPR compliance details.

User Controls

Opt-Out Options

You can give visitors a way to turn off tracking using the tracker's disable command:

<!-- User-facing opt-out -->
<button onclick="zenovay('disable')">
  Don't track my activity
</button>

Respect Do Not Track

Zenovay respects Do Not Track (DNT) and Global Privacy Control (GPC) signals by default, and no additional attribute is needed. A visitor sending either signal is not recorded, because the tracker stops before session replay starts.

The two signals differ in one way. GPC cannot be overridden. DNT can: data-ignore-dnt="true" switches the DNT check off, and that override is applied automatically to any script served through the first-party proxy, so a first-party-tracked site does record DNT visitors.

Third-Party Content

Iframes

Third-party iframes:

Are not recorded across origins (cross-origin iframe recording is disabled for security)
May show a placeholder in playback

Third-Party Scripts

Content loaded from other domains:

May render differently in playback
Font fallbacks are possible
External images may not load

Sensitive Industries

Healthcare

Note that Zenovay is not HIPAA-certified and we do not sign Business Associate Agreements. If you operate in healthcare:

Mask or block all PHI fields and sections
Treat session recordings as out of scope for PHI, or do not enable recording on pages that contain it

Financial Services

For financial data:

Mask all financial fields
Block payment pages with path exclusions
Use audit logging (Scale) to track recording access

Legal Considerations

Consult your legal team about:

Industry requirements
Regional laws
Customer agreements

Audit & Compliance

Audit Logging

Scale Plan

Workspace audit logs track administrative actions, including:

Viewer identity
Timestamp
Action taken

Best Practices

Privacy Checklist

Before enabling recording:

Privacy notice updated to mention session recording
Consent mechanism in place (where required)
Sensitive fields masked or blocked
Excluded paths configured
Team aware of privacy responsibilities

Regular Reviews

Periodically check:

Masking configuration
New sensitive fields added to your site
Consent compliance
Recording mode and exclusions

Documentation

Keep records of:

What you record
Your legal basis
Retention periods
Who can access recordings

Configuration Summary

Configure these in the website's dashboard:

Settings → Advanced: enable Session Replay and set the recording mode (errors only / all sessions)
Settings → Exclusions: add URL paths to exclude, for example /admin/*

For element-level control, add CSS hooks in your HTML:

<div class="zenovay-mask-replay">Masked content</div>
<form id="payment-form" class="zenovay-block-replay">Blocked from recording</form>

Do Not Track and Global Privacy Control are respected by default. data-ignore-dnt="true" switches off the DNT check only, and the first-party proxy applies that override automatically. GPC cannot be overridden.