Using Jot lawfully

You are the controller for your end users' data; Jot is your processor. That means the notices, consents, and legal bases are yours to get right. This page makes that as mechanical as possible.

If your consent management platform (CMP) requires consent before analytics or recording tools run, do not let Jot start on its own. Set data-jot-autostart="false" on the script tag and start the widget only after the CMP grants consent:

<script
  src="https://cdn.jsdelivr.net/npm/@usejot/widget@1/dist/jot.js"
  data-jot-key="jot_pk_your_key"
  data-jot-autostart="false"
></script>

// after your CMP reports consent for the relevant category:
window.Jot.init();

Until init() is called, the loader stays inert — nothing is captured, no network requests are made on your users' behalf.

Mask what recording must not see

Every input is masked by default (maskAllInputs); passwords are always masked regardless of configuration.
Add .jot-block to any element that must not be recorded at all.
Add .jot-mask to any element whose text must be masked.
Masking happens in the end user's browser before upload — never on a server.

What is captured, what never is

Captured (when the reporter acts): a screenshot of the full page — with .jot-block and .jot-mask elements, your project's configured mask selectors, every filled form field, and passwords painted over in the browser before upload — the DOM selector, page URL, browser and OS, and — only if the reporter presses Record — a session replay with console and network activity, subject to masking.

Never captured: password plaintext, masked input values, anything inside .jot-block, or anything at all before the reporter interacts with the widget.

The reporter is told before sending

The composer shows a notice line above the Send button: sending attaches a screenshot of this page, and sensitive fields are masked before anything leaves the browser. The transparency line is built in — nobody submits a screenshot unknowingly.

Domain allowlist — project settings take a list of hostnames (app.acme.com, or *.acme.com wildcards). The API refuses widget traffic from any other site; an empty list allows all sites.
Internal-only mode — set the project's visibility to Internal (the API then refuses anyone who is not a signed-in team member) and add data-jot-internal="true" to the embed: the tab mounts only when the page is visited with ?jot=true, so end users never see it.
Environment tagging — data-jot-env="staging" stamps every report with the deployment it came from, keeping production feedback separate.

A paragraph for your privacy policy

Copy, adapt, and have your counsel confirm:

We use Jot, a feedback tool, to let reviewers report issues on this site. When a reviewer submits feedback, Jot captures a screenshot of the page — with sensitive fields masked before it leaves the browser — the page address, and browser information. If the reviewer starts a session recording, their interactions on the page are recorded with all form input masked before it leaves the browser. This data is processed by Jot on our behalf and retained for up to 30 days (recordings) or for as long as the report is needed. See Jot's privacy documentation for details.

Handling an erasure request

When one of your end users asks you to erase their data, delete the reports and recordings that concern them from Settings → Privacy in your dashboard, which removes the comment, its screenshot, and any recording from storage. Deletion propagates to backups within 35 days. If you cannot locate the report, contact support with the approximate date and page URL.

DPIA assistance

If your deployment needs a Data Protection Impact Assessment (for example, recording on pages used at scale), the DPA commits us to assist. Email privacy@usejot.co and we will provide the technical descriptions (Annexes I and II) in whatever format your assessment needs.