Mask sensitive content

Choose what On-Live leaves out of recordings — masked text, blocked elements, and pages that are never recorded.

Decide what Flamio On-Live leaves out of your visitors' recordings. You mark text to blank, elements to leave out, and pages never to record — all in your own code.

What is recorded by default

Content	Recorded
What visitors type into any field	Never. Every input, text area and select value is replaced with asterisks. No setting turns this off.
Text shown on the page	Yes, as the visitor saw it — unless you mask it.
Elements and images	Yes — unless you block them.
Pages where the SDK runs	Every page — unless you exclude it by address.

Text on screen is recorded

Names, addresses, order details or account numbers that your pages display as text appear in replays. Mask them before you deploy the SDK, or as soon as you find them.

Before you begin

The web SDK is installed. See Install the web SDK.
You need access to your site's code. Every rule on this page is a class in your markup or an option in the Flamio.init call. Nothing is set in the Flamio app.

Mask text in your markup

Add the class flamio-mask, or the attribute data-flamio-mask, to an element. Its text, and the text of everything inside it, is replaced with asterisks in the recording.

Masked text

<p class="flamio-mask">Jane Doe, 1 Example Street</p>
<span data-flamio-mask>Account 0000 0000</span>

Block an element completely

Add the class flamio-block, or the attribute data-flamio-block, to leave an element and everything inside it out of the recording. The replay shows an empty box in its place.

Blocked element

<div class="flamio-block">
  <img src="/id-photo.jpg" alt="ID photo" />
</div>
<section data-flamio-block>Medical history</section>

Or use CSS selectors instead of markup

If you cannot change the markup, pass the same rules to Flamio.init in the snippet from the Setup page:

import { Flamio } from '@flamioai/web-sdk';

Flamio.init({
  projectKey: 'YOUR_KEY_HERE',
  endpoint: 'https://api.flamio.org/api',
  maskSelectors: ['.card-number', '#ssn'],
  blockSelectors: ['.id-photo'],
});

YOUR_KEY_HERE — your project key, as in the Setup snippet.
maskSelectors — CSS selectors whose text is replaced with asterisks, like flamio-mask.
blockSelectors — CSS selectors whose elements are left out, like flamio-block.

Exclude whole pages

To never record some pages, pass urlBlocklist. To record only some pages, pass urlAllowlist.

import { Flamio } from '@flamioai/web-sdk';

Flamio.init({
  projectKey: 'YOUR_KEY_HERE',
  endpoint: 'https://api.flamio.org/api',
  urlBlocklist: ['example.com/admin', 'example.com/account/*'],
});

Replace example.com with your site's host.
A pattern matches any part of the page address, and case does not matter. /admin alone also matches /blog/admin-tips, so include the host.
* is the only wildcard.
When a page matches both lists, the blocklist wins.
A blocked page sends nothing to Flamio.

Deploy and check a replay

Deploy your site. Then open a replay of a visit recorded after the deploy, in Flamio On-Live > Visits. Masked text is blank, and blocked elements are empty boxes.

Result

New recordings leave out what you marked. Rules apply only to visits recorded after the deploy — recordings already stored do not change.

The class flamio-ignore is not a privacy control. On a form field, it only stops Flamio from recording that field's input events, and typed values are masked anyway. The maskTextContent option does not mask recordings in web SDK 0.9.0 either. To hide content, use flamio-mask or flamio-block.

Delete a visitor's recordings

There is no self-serve way to delete one visitor's recordings from the app. For an erasure request, write to contact@flamio.org. To stop capturing such data going forward, use the masking and page rules above.

Privacy in the web SDK — every privacy option in detail
Record only after consent
Identify your visitors
Record your mobile app — what the mobile setup masks

Mask sensitive content

On this page