Control what is recorded

What the web SDK records and masks by default, and how to mask text, block elements and skip pages with classes, selectors and URL rules.

The web SDK masks what visitors type. Everything else your page shows is recorded unless you mask it, block it or keep the SDK off that page. Each rule lives in your own code: a class in your markup or an option of Flamio.init.

Page text is recorded as shown

By default, only input values are masked. Names, addresses, balances and any other text your page displays appear in recordings until you mask or block them.

Masked by default

What visitors type into inputs, text areas and selects is always replaced with asterisks. Password, email and phone fields are masked as well. No option turns this off.

Text in rich-text editors (elements with contenteditable) is page text, not an input value. Mask it like any other text.

Mask text

Masked text is replaced with asterisks of the same length, so the layout keeps its shape. The rule applies to the element and everything inside it.

Add the flamio-mask class or the data-flamio-mask attribute:

<p class="flamio-mask">Balance: $12,480.00</p>
<div data-flamio-mask>
  <span>Ada Lovelace</span>
  <span>12 Example Street</span>
</div>

Or pass CSS selectors, with no markup changes:

import { Flamio } from '@flamioai/web-sdk';

Flamio.init({
  projectKey: 'YOUR_KEY_HERE',
  endpoint: 'https://api.flamio.org/api',
  maskSelectors: ['.account-balance', '#shipping-address'],
});

YOUR_KEY_HERE is your project's API key from Flamio On-Live > Setup.

Block an element

A blocked element is replaced with an empty box of the same size. Nothing inside it is recorded: no text, images or interactions.

Add the flamio-block class or the data-flamio-block attribute:

<img class="flamio-block" src="/id-photo.jpg" alt="ID photo" />
<section data-flamio-block>Medical history</section>

Or pass CSS selectors:

import { Flamio } from '@flamioai/web-sdk';

Flamio.init({
  projectKey: 'YOUR_KEY_HERE',
  endpoint: 'https://api.flamio.org/api',
  blockSelectors: ['.id-photo', '[data-private]'],
});

Stop recording changes to a field

Add the flamio-ignore class to an input, text area or select. Changes to that field are not recorded at all, not even as asterisks. Put the class on the field itself: on a container, it has no effect on the fields inside.

<input class="flamio-ignore" name="promo-code" />

The maskTextContent option

maskTextContent does not mask recordings in 0.9.0

Setting maskTextContent: true leaves page text visible in recordings. To hide text, use flamio-mask, data-flamio-mask or maskSelectors.

Skip whole pages

Use urlBlocklist to never record some pages, or urlAllowlist to record only some pages. The blocklist wins. While the visitor is on a page that does not pass, nothing is recorded — not the page, its console errors or its failed requests.

import { Flamio } from '@flamioai/web-sdk';

Flamio.init({
  projectKey: 'YOUR_KEY_HERE',
  endpoint: 'https://api.flamio.org/api',
  urlBlocklist: ['example.com/account/*', 'example.com/admin'],
});

Replace example.com with your site's host. Patterns match anywhere in the full URL, ignoring case, and * is the only wildcard. See URL filtering.

What the SDK records

Data	What is recorded
Page content	The page's structure and visible text, and how they change. Images are recorded by their URL.
Interactions	Mouse movement, clicks, scrolling and touches, and that a field changed (its value masked).
Addresses	The URL of every page and route, the referrer, and the UTM parameters of the entry page.
Console	Errors, uncaught exceptions and unhandled promise rejections, with message, source location and stack. Warnings only with `captureConsoleWarn`.
Network	Requests that fail (status 400 or higher, or no response) or are slow: method, URL, status and timing.
Performance	Core Web Vitals of the page load: LCP, INP and CLS.
Scroll depth	How far down each page the visitor scrolled.
Tab visibility	When the tab was hidden and shown again.
Form validation	Which field the browser rejected when a form was submitted — not its value.
Device	User agent, screen and window size, pixel ratio, whether the device is mobile, and a few browser signals that tell automated traffic from people.
Your data	The `version` you set, and the user ID and traits you pass to `Flamio.identify`.

Page and request URLs are recorded as they are, query string included. Do not put personal data or secrets in URLs, or keep those pages out with urlBlocklist.

Long console messages are shortened, rapid repeats of the same message are combined, and each page keeps a limited number of console entries.

What the SDK never records

Values typed into inputs, text areas and selects.
Request or response bodies and headers, and requests that succeed without being slow.
Cookies, and the contents of localStorage or sessionStorage.
The content of canvas elements and of cross-origin iframes, such as embedded payment forms, videos or maps.
console.log, console.info and console.debug messages, and console.warn unless you turn it on.
A browser fingerprint: no canvas, WebGL or font probing.
Anything while the visitor is on a page your URL rules exclude.

What the SDK stores in the browser

The SDK keeps an anonymous visitor ID and the current visit in your site's localStorage. If Flamio refuses your project key, it also stores a marker there to pause sending. It sets no cookies.

With consent: 'wait', nothing is stored until Flamio.consent('granted'). See Record only after consent.

When the rules apply

Masking, blocking and URL rules apply to sessions recorded after you deploy them. Recordings already stored do not change.

Control what is recorded

On this page