Privacy & masking

Read this before you turn on recording, and send it to whoever runs your security review.

The guarantee

Masking happens in the browser, before anything is uploaded. There is no moment when unmasked content sits on a server waiting to be cleaned up. If a field is masked, its plaintext never leaves the visitor's machine.

A test in Jot's own suite checks exactly this against the raw uploaded bytes.

Masked by default

You don't configure any of this:

• Every input value. Recording runs with maskAllInputs on.
• Passwords, always — even if everything else were unmasked.
• In screenshots, every form field holding a typed value, and password fields even when empty.

Marking your own content

Add a class to any element:

<section class="jot-block">
  <!-- bank details: never recorded, never in a screenshot -->
</section>

<span class="jot-mask">Ada Lovelace</span>

For anything that appears on many pages, add CSS selectors once in Project → Settings → Recording privacy instead. They are masked everywhere, in recordings and screenshots.

Screenshots

Every Jot carries a screenshot of the page. Before the image exists as bytes, the widget paints over everything above, on a canvas in the reporter's browser. Only the painted-over pixels are uploaded. There is no unmasked copy, in transit or at rest.

The reporter is told before they send: Screenshot & selector attached. Sensitive fields masked before anything leaves your browser.

Network requests

A recording keeps the page's fetch and XMLHttpRequest calls the way the browser's Network tab shows them: URL, method, status, timing, headers, and the request and response bodies. Jot's own calls are never recorded.

Before any of it is uploaded, in the visitor's browser:

• Credential headers are redacted — Authorization, Cookie, Set-Cookie, API-key and CSRF headers, and any header whose name contains token, secret, session, auth, key or password. The name is kept; the value becomes [redacted].
• Secret fields in bodies are redacted — in JSON (at any depth) and form bodies, and in the URL's query string: passwords, tokens, secrets, API keys, credentials, session ids, card numbers, CVV/CVC, IBAN, SSN, PINs, one-time and verification codes.
• Masked content stays masked — anything typed into a masked field, or shown inside jot-mask, jot-block or your own selectors, is replaced with [masked] wherever it appears in a URL, header or body.
• Only text is kept — JSON, text, XML and form bodies, up to 16 KB each. Files, images, binary data and streams are noted by type, never read.

To keep headers and timing but no bodies at all, turn off Capture request and response bodies in Project → Settings → Recording privacy.

What recording can't capture

Recording copies the page's structure, not the screen. It cannot see:

• other browser tabs
• anything outside the page
• the desktop, notifications, or other apps

It never asks for screen-sharing permission, because it never needs it.

Keeping a key on your own sites

In Project → Settings → Allowed domains, list the hostnames the widget may run on — app.acme.com, or *.acme.com for every subdomain. Jot refuses requests from anywhere else, so a copied project key is useless off your domains. An empty list allows every site.

Retention

Recordings are kept for 30 days by default. Change it in Settings → General → Recording retention, anywhere from 1 to 365.

Your obligations

You are recording your own users. Using Jot lawfully covers consent, notices and erasure requests.