# Privacy & masking

> What leaves the browser, what never does, and how to control it.

Source: https://docs.usejot.co/docs/privacy

Read this before you turn on recording, and send it to whoever runs your
security review.

## The guarantee

**Masking happens in the browser, before anything is uploaded.** There is no
moment when unmasked content sits on a server waiting to be cleaned up. If a
field is masked, its plaintext never leaves the visitor's machine.

A test in Jot's own suite checks exactly this against the raw uploaded bytes.

## Masked by default

You don't configure any of this:

* **Every input value.** Recording runs with `maskAllInputs` on.
* **Passwords**, always — even if everything else were unmasked.
* In screenshots, **every form field holding a typed value**, and password
  fields even when empty.

## Marking your own content

Add a class to any element:

| Class        | In recordings                                      | In screenshots |
| ------------ | -------------------------------------------------- | -------------- |
| `jot-mask`   | Text replaced with asterisks, layout kept          | Painted over   |
| `jot-block`  | Not recorded at all — replays as a same-size blank | Painted over   |
| `jot-ignore` | Recorded, but typing in it is not                  | —              |

```html
<section class="jot-block">
  <!-- bank details: never recorded, never in a screenshot -->
</section>

<span class="jot-mask">Ada Lovelace</span>
```

For anything that appears on many pages, add CSS selectors once in
**Project → Settings → Recording privacy** instead. They are masked everywhere,
in recordings and screenshots.

## Screenshots

Every Jot carries a screenshot of the page. Before the image exists as bytes,
the widget paints over everything above, on a canvas in the reporter's browser.
Only the painted-over pixels are uploaded. There is no unmasked copy, in transit
or at rest.

The reporter is told before they send: *Screenshot & selector attached.
Sensitive fields masked before anything leaves your browser.*

## Network requests

A recording keeps the page's `fetch` and `XMLHttpRequest` calls the way the
browser's Network tab shows them: URL, method, status, timing, headers, and the
request and response bodies. Jot's own calls are never recorded.

Before any of it is uploaded, in the visitor's browser:

* **Credential headers are redacted** — `Authorization`, `Cookie`,
  `Set-Cookie`, API-key and CSRF headers, and any header whose name contains
  *token*, *secret*, *session*, *auth*, *key* or *password*. The name is kept;
  the value becomes `[redacted]`.
* **Secret fields in bodies are redacted** — in JSON (at any depth) and form
  bodies, and in the URL's query string: passwords, tokens, secrets, API keys,
  credentials, session ids, card numbers, CVV/CVC, IBAN, SSN, PINs, one-time
  and verification codes.
* **Masked content stays masked** — anything typed into a masked field, or
  shown inside `jot-mask`, `jot-block` or your own selectors, is replaced with
  `[masked]` wherever it appears in a URL, header or body.
* **Only text is kept** — JSON, text, XML and form bodies, up to 16 KB each.
  Files, images, binary data and streams are noted by type, never read.

To keep headers and timing but no bodies at all, turn off **Capture request
and response bodies** in **Project → Settings → Recording privacy**.

## What recording can't capture

Recording copies the page's structure, not the screen. It cannot see:

* other browser tabs
* anything outside the page
* the desktop, notifications, or other apps

It never asks for screen-sharing permission, because it never needs it.

## Keeping a key on your own sites

In **Project → Settings → Allowed domains**, list the hostnames the widget may
run on — `app.acme.com`, or `*.acme.com` for every subdomain. Jot refuses
requests from anywhere else, so a copied project key is useless off your
domains. An empty list allows every site.

## Retention

Recordings are kept for 30 days by default. Change it in
**Settings → General → Recording retention**, anywhere from 1 to 365.

## Your obligations

You are recording your own users. [Using Jot lawfully](/docs/legal/using-jot-lawfully)
covers consent, notices and erasure requests.