Zenovay's session replay records DOM mutations, not pixels. That means we never capture screenshots of your visitors' screens. But the recorded DOM still contains the text content of every node, so the recorder applies masking to keep PII out of the recording.
What's masked by default
Without any configuration:
- Every
<input>,<textarea>, and<select>value is masked — the recorder captures the field but replaces its value with asterisks. This is on by default for all input types. passwordfields are always masked at the character level and can never be un-masked.- Canvas elements are not recorded at all.
So out of the box, anything a visitor types into a form already stays out of the recording. The hooks below are for masking or hiding content that isn't a form field, or for sensitive areas you want to remove entirely.
Masking custom text
To mask the text content of any element (a customer ID, an order total, an internal note), add the class zenovay-mask-replay:
<div class="zenovay-mask-replay">
Customer #ABC-1234
</div>
The element still appears in the recording with its layout intact, but its text is replaced with masked characters before the recording leaves the browser. The real value never reaches Zenovay's servers.
Hiding an element entirely
If you want an element left out of the recording completely (not just masked) — for example an embedded card form or a section of a screen showing other people's data — block it. Add the class zenovay-block-replay, or the attribute data-private:
<div class="zenovay-block-replay">
<!-- replaced with an empty placeholder of the same size -->
</div>
<div data-private>
<!-- also blocked from the recording -->
</div>
A blocked element shows up in the player as an empty placeholder of the same dimensions, so the layout stays recognizable while the content is gone.
Ignoring input events
To keep an input visible in the recording but stop the recorder from capturing what the user does inside it, add zenovay-ignore-replay:
<input class="zenovay-ignore-replay" name="ssn" />
The field renders in the recording, but the keystrokes and value changes are ignored.
Excluding a whole page
There's no page-level "off" attribute. If you don't want replay to run on a page at all (a high-privacy admin screen, an internal-only page), turn session replay off for that domain, or block the page's main container with zenovay-block-replay. Pageviews and events are still tracked either way.
How to verify
Open a fresh recording from your website's dashboard — go to Audience → Sessions — and scrub to a frame that contains a masked or blocked area. Masked text should appear as asterisks; blocked elements should appear as empty placeholders. If you still see a real value, double-check that the class or attribute is on the element before the user interacts with it, not added afterwards.