Your visitors' sessions stay with you

Replayowl is software you run, not a service you send data to. Recordings travel from your visitor's browser to your server and into your storage. There is no Replayowl account, no telemetry and no copy anywhere else.

Where recordings goThe recorder in the visitor's browser masks sensitive text, then sends batches to your Replayowl server. The server writes recordings to your bucket and summaries to your database. Your signed-in browser reads them back for replay. Nothing goes to third parties.Visitor's browserrecorder.js masks inputs,emails and card numbersbefore anything is sentYour Replayowl serverCloudflare Worker or Node/api/ingest accepts batchesDashboard needs the adminpasswordYour bucketgzipped recordingsYour databasesummaries and searchYou, signed inreplays in your browserHTTPS batchesread for replay
Every box in this picture is yours. There is no arrow to us because nothing is sent to us.

What is recorded

  • The page structure and styles, as a snapshot when it loads and then every change.
  • Mouse and touch movement, clicks, scrolling, viewport size, focus and tab visibility.
  • Form activity, with every text input masked by default.
  • Console errors and warnings, uncaught exceptions and rejected promises, with stack traces. Turn this off with captureLogs: false.
  • The user agent, device type and the URLs of pages visited.
  • A user ID, only if you pass one with identify or data-user-id.

What is not recorded

  • Real values of text inputs, unless you mark a field with data-ro-unmask. Password fields, card fields and fields named like CVV or IBAN can never be unmasked.
  • Email addresses and runs of 12 to 19 digits in page text.
  • Anything inside an element marked data-ro-block.
  • Network requests and their bodies, cookies, and local storage.
  • Contents of iframes and canvas elements.
  • IP addresses are not stored with sessions. The server reads the address only to rate-limit failed sign-ins.

Masking happens in the browser. Characters are replaced with * before the batch is built, so the original text is never uploaded. Details are in Masking and privacy.

Who can see recordings

Only someone who signs in to your dashboard with the admin password, or who has access to your bucket and database. The password is hashed with PBKDF2-SHA256 and 100,000 iterations; the sign-in cookie is HttpOnly, SameSite=Lax and signed with HMAC; repeated failed sign-ins are locked out. See Admin sign-in.

Retention and deletion

Recordings stay until you delete them. Delete one session from the dashboard or the API, or use your bucket's lifecycle rules for bulk expiry. The storage layout is documented in Storage and your data.

Compliance

Self-hosting means no third party processes your visitors' sessions, which is the gap that hosted tools cannot close. Microsoft Clarity's own terms, for example, make Microsoft an independent controller of the data rather than your processor. Whether you need visitor consent before recording still depends on your jurisdiction and purpose; if you do, start the recorder from code after consent with ReplayOwl.start().

Reporting a vulnerability

Please report security issues privately through GitHub security advisories rather than a public issue.