Docs Any website
Privacy and masking
What is never recorded, what is masked, and how to control it on your pages.
Masking happens in the visitor's browser, before anything leaves it.
Never recorded
Whatever the settings:
- password fields, card number, CVV and one-time-code fields;
- fields named like secrets: API key, token, secret, signature, private key, passphrase, webhook, licence key;
- the contents of payment-provider iframes, which browsers don't allow anyone to record.
Masking levels
Each site has a masking level, set in OpL Insights under Websites > Manage:
| Level | What is masked |
|---|---|
| Personal data (default) | Names, e-mail addresses, phone numbers, addresses and comment fields. Quantities, searches, coupon codes and option choices stay readable. |
| All text | Every piece of text and every input. You see the layout and the clicks, not the words. |
| None | Nothing beyond the fields that are never recorded. Use only for internal tools. |
Marking your own elements
Add a class to any element in your templates:
| Class | Effect |
|---|---|
opl-no-record |
The element is replaced by an empty box in recordings. |
opl-mask |
Its text and inputs are masked, whatever the site's level. |
opl-unmask |
Its text and inputs are recorded as they are, in Personal data mode. |
<div class="account-balance opl-no-record">R 12 450.00</div>
Console and network
Console messages and failed network requests are attached to recordings. Passwords, tokens, keys and card numbers are always masked in them, and the site's masking level applies too. With All text, no request or response bodies are kept.
How data is kept
Data is stored on servers operated for OpL Insights and is seen only by the people each site gives access to. Data is kept for the period of the plan: 30 days on Free, 3 months on Standard, 6 months on Pro and 12 months on Business. If you use Ask OpL Insights, the masked data it reads is sent to Anthropic's API to write the answer; mention this in your privacy notice.